CVE-2024-56324
📋 TL;DR
GoCD versions before 24.5.0 contain an XML External Entity (XXE) vulnerability that allows group administrators to inject malicious XML when editing pipeline configurations. This could lead to server-side request forgery (SSRF), information disclosure, or directory traversal attacks. Only GoCD instances with group admin users who can edit XML configurations are affected.
💻 Affected Systems
- GoCD
📦 What is this software?
Gocd by Thoughtworks
⚠️ Risk & Real-World Impact
Worst Case
Group admin could read arbitrary files from the GoCD server, perform SSRF attacks against internal systems, or potentially execute remote code through XXE processing.
Likely Case
Information disclosure from the GoCD server filesystem, including configuration files, credentials, or sensitive data stored on the server.
If Mitigated
Limited impact with proper network segmentation and egress controls preventing external requests from the GoCD server.
🎯 Exploit Status
Exploitation requires group admin privileges and knowledge of XXE payloads. No public exploit code is available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 24.5.0
Vendor Advisory: https://github.com/gocd/gocd/security/advisories/GHSA-3w9f-fgr5-5g78
Restart Required: No
Instructions:
1. Backup your GoCD configuration and data. 2. Download GoCD 24.5.0 from the official releases page. 3. Follow the upgrade instructions for your deployment method (package, Docker, manual). 4. Verify the upgrade completed successfully.
🔧 Temporary Workarounds
Block XML editing endpoints
allTemporarily block access to vulnerable endpoints via reverse proxy or WAF if group admins don't need direct XML editing
Block requests to /go/*/pipelines/snippet
Implement egress controls
allPrevent GoCD server from making outbound requests to arbitrary locations
Configure firewall rules to restrict outbound connections from GoCD server
🧯 If You Can't Patch
- Remove group admin privileges from untrusted users
- Implement strict network segmentation to limit GoCD server's access to internal resources
🔍 How to Verify
Check if Vulnerable:
Check GoCD version via admin interface or by examining server logs/configurationCheck Version:
Check GoCD server logs for version information or use the admin dashboardVerify Fix Applied:
Verify version is 24.5.0 or later and test that XXE payloads in pipeline XML are properly rejected📡 Detection & Monitoring
Log Indicators:
- Unusual XML parsing errors
- Requests to /go/*/pipelines/snippet with XML content
- Outbound requests from GoCD server to unexpected destinations
Network Indicators:
- GoCD server making HTTP requests to internal systems it shouldn't access
- Unusual file read patterns from the GoCD server
SIEM Query:
source="gocd" AND (uri="/go/*/pipelines/snippet" OR message="XML parsing error")