CVE-2021-43287: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: An issue was discovered in ThoughtWorks GoCD before 21.3.0. The business continuity add-on, which is enabled by default, leaks all secrets known to the GoCD server to unauthenticated attackers.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 7.5
Published: 2022-04-14T12:15Z
Repository: https://github.com/gocd/gocd
Language: Java
Files changed: server/src/main/java/com/thoughtworks/go/addon/businesscontinuity/primary/controller/PrimaryStatusProviderController.java, server/src/main/java/com/thoughtworks/go/addon/businesscontinuity/standby/controller/DashBoardController.java
Commit date: 2021-10-18 20:41:06 +0100
Commit message: #000 - Disable business-continuity

Diff: diff --git a/server/src/main/java/com/thoughtworks/go/addon/businesscontinuity/primary/controller/PrimaryStatusProviderController.java b/server/src/main/java/com/thoughtworks/go/addon/businesscontinuity/primary/controller/PrimaryStatusProviderController.java
index 77d1163223..21a9207292 100644
--- a/server/src/main/java/com/thoughtworks/go/addon/businesscontinuity/primary/controller/PrimaryStatusProviderController.java
+++ b/server/src/main/java/com/thoughtworks/go/addon/businesscontinuity/primary/controller/PrimaryStatusProviderController.java
@@ -42,11 +42,10 @@ import static org.apache.commons.io.IOUtils.copy;
 import static org.apache.commons.lang3.StringUtils.isBlank;
 import static org.apache.commons.lang3.StringUtils.isEmpty;
 
 @Controller
 @SuppressWarnings("WeakerAccess")
-@RequestMapping(value = "/add-on/business-continuity/api")
 public class PrimaryStatusProviderController {
 
     private GoFilesStatusProvider goFilesStatusProvider;
     private DatabaseStatusProvider databaseStatusProvider;
     private final SystemEnvironment systemEnvironment;
diff --git a/server/src/main/java/com/thoughtworks/go/addon/businesscontinuity/standby/controller/DashBoardController.java b/server/src/main/java/com/thoughtworks/go/addon/businesscontinuity/standby/controller/DashBoardController.java
index 7a57114520..518926512b 100644
--- a/server/src/main/java/com/thoughtworks/go/addon/businesscontinuity/standby/controller/DashBoardController.java
+++ b/server/src/main/java/com/thoughtworks/go/addon/businesscontinuity/standby/controller/DashBoardController.java
@@ -73,17 +73,15 @@ public class DashBoardController {
         this.authToken = authToken;
         this.dashboardHTML = this::showStatusPage;
         this.dashboardJSON = this::showStatusJSON;
     }
 
-    @RequestMapping(value = "/add-on/business-continuity/admin/dashboard", method = RequestMethod.GET)
     @ResponseBody
     public String dashboard(HttpServletRequest request, HttpServletResponse response) {
         return renderAfterAuthentication(request, response, dashboardHTML);
     }
 
-    @RequestMapping(value = "/add-on/business-continuity/admin/dashboard.json", method = RequestMethod.GET, produces = MediaType.APPLICATION_JSON_VALUE)
     @ResponseBody
     public String dashboardData(HttpServletRequest request, HttpServletResponse response) {
         return renderAfterAuthentication(request, response, dashboardJSON);
     }
 

Vulnerable code: @RequestMapping(value = "/add-on/business-continuity/api")
    @RequestMapping(value = "/add-on/business-continuity/admin/dashboard", method = RequestMethod.GET)
    @RequestMapping(value = "/add-on/business-continuity/admin/dashboard.json", method = RequestMethod.GET, produces = MediaType.APPLICATION_JSON_VALUE)