GoCD up to 24.4.0 /go/*/pipelines/snippet xml external entity reference

Summaryinfo

A vulnerability, which was classified as problematic, was found in GoCD up to 24.4.0. Impacted is an unknown function of the file /go/*/pipelines/snippet. Executing a manipulation can lead to xml external entity reference. This vulnerability is tracked as CVE-2024-56324. The attack can be launched remotely. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in GoCD up to 24.4.0. This vulnerability affects some unknown functionality of the file /go/*/pipelines/snippet. The manipulation with an unknown input leads to a xml external entity reference vulnerability. The CWE definition for the vulnerability is CWE-611. The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

GoCD is a continuous deliver server. GoCD versions prior to 24.4.0 can allow GoCD "group admins" to abuse ability to edit the raw XML configuration for groups they administer to trigger XML External Entity (XXE) injection on the GoCD server. Theoretically, the XXE vulnerability can result in additional attacks such as SSRF, information disclosure from the GoCD server, and directory traversal, although these additional attacks have not been explicitly demonstrated as exploitable. This issue is fixed in GoCD 24.5.0. Some workarounds are available. One may temporarily block access to `/go/*/pipelines/snippet` routes from an external reverse proxy or WAF if one's "group admin" users do not need the functionality to edit the XML of pipelines directly (rather than using the UI, or using a configuration repository). One may also prevent external access from one's GoCD server to arbitrary locations using some kind of environment egress control.

The advisory is shared for download at github.com. This vulnerability was named CVE-2024-56324 since 12/19/2024. The exploitation appears to be difficult. The attack can be initiated remotely. Additional levels of successful authentication are required for exploitation. There are known technical details, but no exploit is available.

Upgrading to version 24.5.0 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• GoCD

Version

• 24.0
• 24.1
• 24.2
• 24.3
• 24.4.0

Website

• Product: https://github.com/gocd/gocd/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion