Description
GoCD是ThoughtWorks公司推出的开源持续交付/持续集成（CD/CI）平台，是企业级DevOps工具的首选平台。该产品采用Java开发，提供可视化流水线、版本控制集成、自动化部署、环境管理等功能，广泛应用于软件开发、测试、运维等DevOps场景。GoCD /go/admin/pipelines/create 接口存在未授权访问漏洞，攻击者无需认证即可访问流水线创建页面，可能导致恶意流水线创建、代码注入等安全风险。
GoCD /go/admin/pipelines/create 未授权访问漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://www.sonarsource.com/blog/gocd-pre-auth-pipeline-takeover
https://www.sentinelone.com/vulnerability-database/cve-2021-43287/
https://github.com/gocd/gocd/security/advisories/GHSA-346h-q594-rj8j
https://pulsesecurity.co.nz/advisories/GOCD-Multiple-Vulnerabilities
https://censys.com/blog/gocd-unauthenticated-takeover
https://www.rapid7.com/db/vulnerabilities/http-gocd-cve-2021-43287/
https://blueteamalpha.com/blog/gocd-vulnerability-allows-potential-for-supply-chain-attacks/
https://cn-sec.com/archives/2490856.html