#############################################################

#
# COMPASS SECURITY ADVISORY
# https://www.compass-security.com/research/advisories/
#
#############################################################
#
# Product: Gradle Enterprise [1]
# Vendor: Gradle
# CSNC ID: CSNC-2020-015
# CVE ID: CVE-2020-15768
# Subject: Potential disclosure of session cookies via header reflection
# Risk: Low
# Effect: Remotely exploitable
# Author: Marat Aytuganov <marat.aytuganov@compass-security.com>
# Date: 12.10.2020
#
#############################################################

Introduction
------------
Gradle Enterprise is the tool of choice for the world’s most valuable global
business and technology brands that compete on the delivery speed and quality
of their code. Gradle Enterprise leverages acceleration technologies to speed
up the software build and test process and data analytics to make
troubleshooting more efficient. It is a key enabling technology for the
emerging discipline of Developer Productivity Engineering. [1]

Affected
--------

Vulnerable:
* Gradle Enterprise 2017.3 - 2020.2.4
* Gradle Enterprise Build Cache Node 1.0 - 9.2

Not vulnerable:
* 2020.2.5

Technical Description
---------------------
Gradle Enterprise exposes endpoints, which reflect the HTTP request headers
in the body of the HTTP response. These endpoints can be used in a Cross-Site
Scripting (see CVE-2020-15769) attack to extract authentications Cookies that
are protected with the HttpOnly flag and steal sessions of users and
administrators.

Gradle Enterprise affected application request paths:

/info/headers
/cache-info/headers
/admin-info/headers
/distribution-broker-info/headers

Gradle Enterprise Build Cache Node affected application request paths:

/cache-node-info/headers
Workaround / Fix
----------------
Upgrade to Gradle Enterprise 2020.2.5 or later.

Timeline
--------
2020-06-26: Discovery by Marat Aytuganov
2020-06-26: Initial vendor notification
2020-06-26: Initial vendor response
2020-09-15: Assigned CVE-2020-15768
2020-07-13: Release of fixed Version / Patch

References
----------
[1] https://gradle.com/gradle-enterprise-solution-overview/