CVE - CVE-2024-56324

CVE-ID
CVE-2024-56324	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
GoCD is a continuous deliver server. GoCD versions prior to 24.4.0 can allow GoCD "group admins" to abuse ability to edit the raw XML configuration for groups they administer to trigger XML External Entity (XXE) injection on the GoCD server. Theoretically, the XXE vulnerability can result in additional attacks such as SSRF, information disclosure from the GoCD server, and directory traversal, although these additional attacks have not been explicitly demonstrated as exploitable. This issue is fixed in GoCD 24.5.0. Some workarounds are available. One may temporarily block access to `/go/*/pipelines/snippet` routes from an external reverse proxy or WAF if one's "group admin" users do not need the functionality to edit the XML of pipelines directly (rather than using the UI, or using a configuration repository). One may also prevent external access from one's GoCD server to arbitrary locations using some kind of environment egress control.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://github.com/gocd/gocd/commit/410331a97eb2935e04c1372f50658e05c533f733 URL:https://github.com/gocd/gocd/commit/410331a97eb2935e04c1372f50658e05c533f733 MISC:https://github.com/gocd/gocd/releases/tag/24.5.0 URL:https://github.com/gocd/gocd/releases/tag/24.5.0 MISC:https://github.com/gocd/gocd/security/advisories/GHSA-3w9f-fgr5-5g78 URL:https://github.com/gocd/gocd/security/advisories/GHSA-3w9f-fgr5-5g78 MISC:https://www.gocd.org/releases/#24-5-0 URL:https://www.gocd.org/releases/#24-5-0
Assigning CNA
GitHub (maintainer security advisories)
Date Record Created
20241218	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20241218)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)