CoinTR Pro Disclosed Report

www.cointr.com

The GoCD encryption key is a sensitive piece of information used to encrypt and decrypt secret variables within your GoCD configuration. Knowing this key allows someone to decrypt any confidential information stored in GoCD, like passwords or API keys.

Here's some key information about the GoCD encryption key:

• Storage: GoCD stores the encryption key in a file named cipher.aes. This file's location depends on your setup, but it's commonly found in /godata/config/cipher.aes for Docker deployments.
• Security Concerns: - Exposure: In GoCD versions before 21.1.0, the encryption key was accidentally leaked to authenticated agents, potentially allowing them to decrypt secrets https://hackenproof.com/redirect?url=https://hackenproof.com/redirect?url=https://github.com/go-git/go-git/security/advisories/GHSA-449p-3h89-pw88. Make sure you are running a version 21.1.0 or later to avoid this vulnerability.
  • Storage: The cipher.aes file itself needs to be well protected. Avoid committing it to version control systems.

Here are some resources for further reading:

• GoCD Secret Management: https://hackenproof.com/redirect?url=https://docs.gocd.org/current/configuration/secrets_management.html
• GoCD Security Advisories: https://hackenproof.com/redirect?url=https://hackenproof.com/redirect?url=https://github.com/go-git/go-git/security/advisories/GHSA-449p-3h89-pw88 (Look for advisories mentioning "encryption key")

POC

go to : https://ops-header-ws.cointr.com/go/add-on/business-continuity/api/cipher.aes