Loading vulnerability…
In ThoughtWorks GoCD before version 21.3.0, a vulnerability exists where a malicious GoCD Agent can inject arbitrary JavaScript into a failed Job Report. This occurs because user-controlled input from the agent is not properly sanitized before being rendered in the web interface, leading to a stored cross-site scripting (XSS) condition.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This four-file repository contains a Python proof-of-concept exploit chain for ThoughtWorks GoCD releases before 21.3.0, explicitly providing a Docker Compose lab for GoCD 20.10.0. The primary entry point, gocd_rce_noauth.py, takes a target URL and arbitrary command. It retrieves the Business Continuity cruise_config endpoint to obtain server keys, traverses the plugin endpoint to read /proc/self/environ and /etc/go/jetty.xml, writes a local backup and a command-injected replacement Jetty XML file, obtains a token and registers a fake agent, and calculates the HMAC-based remoting authorization header. It invokes local ysoserial.jar with AspectJWeaverFileUpload1 to replace /etc/go/jetty.xml and AspectJWeaverFileRead1 to induce the subsequent server behavior, sending both serialized payloads to remoteBuildRepository. The intended outcome is execution of the supplied command by Java Runtime.exec when Jetty processes the altered configuration. The secondary gocd_urldns.py is an authenticated out-of-band validation utility: it logs in, retrieves keys, enumerates agents to reuse an agent UUID, creates a ysoserial URLDNS payload for an operator-provided interaction URL, and posts it to the same remoting endpoint. docker-compose.yml provisions intentionally vulnerable GoCD server and agent containers, exposes GoCD on 8153/8154, and includes an optional Python listener on 9090. README.md documents the CVE chain, setup, exploitation, and mitigations. TLS certificate verification is disabled in both scripts.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
No public activity tracked yet. Mallory keeps watching.
No public activity observed for this vulnerability.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.