CVE-2024-56324

Executive Summary

CVE-2024-56324 is an XML External Entity (XXE) injection vulnerability in GoCD, a continuous delivery server. The flaw allows authenticated "group admins" to abuse the ability to edit raw XML configuration for groups they administer, leading to XXE injection on the GoCD server. This can potentially enable Server-Side Request Forgery (SSRF), information disclosure, and directory traversal. The vulnerability affects GoCD versions prior to 24.4.0 and is fixed in version 24.5.0. No public proof-of-concept or exploit code is available at this time.

Supply Chain & Package Security

GoCD is a Java-based application distributed as a standalone server. The vulnerability is in the core server component, not in a package manager dependency. However, organizations using GoCD should verify their deployment version and apply the patch immediately.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder. Based on the vulnerability description, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – The vulnerability is exploitable over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): High (H) – Requires group admin privileges.
• User Interaction (UI): None (N) – No user interaction is needed.
• Scope (S): Unchanged (U) – The vulnerable component is the only one affected.
• Confidentiality (C): High (H) – Potential information disclosure.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): Low (L) – Potential denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L Estimated Base Score: 6.0 (Medium)

Threat Level: Medium – Exploitation requires authenticated access with group admin privileges, but the potential impact includes SSRF and information disclosure.

Deep Dive & Mechanics

The vulnerability exists in the XML configuration editing functionality for pipeline groups. GoCD allows group admins to edit the raw XML configuration of pipelines within their group. The XML parser used to process this input does not properly disable external entity processing, allowing an attacker to inject malicious XML entities.

Root Cause: The XML parser is configured to resolve external entities by default. When a group admin submits a crafted XML payload containing an external entity reference, the server fetches the external resource and includes its content in the parsed output.

Attack Flow:

1. An attacker with group admin privileges accesses the pipeline snippet editing endpoint (/go/*/pipelines/snippet).
2. The attacker crafts an XML payload that includes an external entity definition pointing to a local file (e.g., /etc/passwd) or an internal service (e.g., http://internal-service/).
3. The server processes the XML, resolves the external entity, and includes the content in the response or error message.
4. The attacker can then read sensitive files or perform SSRF attacks against internal services.

Potential Impacts:

• Information Disclosure: Read arbitrary files from the GoCD server filesystem.
• SSRF: Make requests to internal services, potentially leading to further compromise.
• Directory Traversal: Access files outside the intended directory.

Vulnerable vs. Patched Code

Vulnerable Code (GoCD < 24.4.0): The XML parser is configured without disabling external entity processing. Example vulnerable configuration:

DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
DocumentBuilder builder = factory.newDocumentBuilder();
Document doc = builder.parse(new InputSource(new StringReader(xmlInput)));

Patched Code (GoCD 24.5.0): The XML parser is configured to disable external entity processing:

DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
DocumentBuilder builder = factory.newDocumentBuilder();
Document doc = builder.parse(new InputSource(new StringReader(xmlInput)));

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a GoCD server (version < 24.4.0)
• Group admin credentials

Exploitation Steps:

1. Log in to the GoCD web interface as a group admin.
2. Navigate to the pipeline snippet editing endpoint: /go/admin/pipelines/snippet
3. Submit a crafted XML payload to read a local file:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<foo>&xxe;</foo>

4. The server will respond with the contents of /etc/passwd included in the error message or response.

SSRF Exploitation:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "http://internal-service/admin">
]>
<foo>&xxe;</foo>

Blue Team

Detection:

• Monitor for unusual XML payloads in pipeline snippet editing requests.
• Look for requests containing <!DOCTYPE, <!ENTITY, or SYSTEM keywords.
• Monitor outbound connections from the GoCD server to unexpected destinations.

Hunting:

• Search logs for requests to /go/*/pipelines/snippet with XML content.
• Check for error messages containing file contents or internal service responses.

Lab Setup:

1. Deploy a vulnerable GoCD instance (version 24.3.0 or earlier) in an isolated environment.
2. Create a group admin user.
3. Use a tool like Burp Suite or curl to send crafted XML payloads.
4. Monitor server logs and network traffic for signs of exploitation.

Indicators of Compromise (IOCs)

Network IOCs:

• Outbound connections from the GoCD server to unexpected IP addresses or domains.
• HTTP requests containing XML with <!DOCTYPE or <!ENTITY declarations.

File System IOCs:

• Unexpected files accessed on the GoCD server (e.g., /etc/passwd, /etc/shadow).
• Temporary files created by the XML parser.

Log IOCs:

• Error messages containing file contents or internal service responses.
• Repeated requests to /go/*/pipelines/snippet with XML payloads.

Sample IOC Log Entry:

[2025-01-15 10:30:45] ERROR - Failed to parse pipeline XML: org.xml.sax.SAXParseException: External entity: file:///etc/passwd

Detection Engineering

YARA Rule

rule CVE_2024_56324_XXE_GoCD {
    meta:
        description = "Detects XXE payloads targeting GoCD pipeline snippet editing"
        author = "Valters IT"
        date = "2025-01-15"
        reference = "CVE-2024-56324"
    strings:
        $xxe1 = "<!DOCTYPE" nocase
        $xxe2 = "<!ENTITY" nocase
        $xxe3 = "SYSTEM" nocase
        $xxe4 = "file:///" nocase
        $xxe5 = "http://" nocase
        $xxe6 = "https://" nocase
    condition:
        all of ($xxe1, $xxe2, $xxe3) and 1 of ($xxe4, $xxe5, $xxe6)
}

Sigma Rule

title: GoCD XXE Injection via Pipeline Snippet Editing
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects XXE payloads in GoCD pipeline snippet editing requests
author: Valters IT
date: 2025-01-15
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-56324
logsource:
    category: webserver
    product: goaccess
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem|contains: '/pipelines/snippet'
        cs-uri-query|contains|all:
            - '<!DOCTYPE'
            - '<!ENTITY'
            - 'SYSTEM'
    condition: selection
falsepositives:
    - Legitimate XML editing with external entities (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-56324 GoCD XXE Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/pipelines/snippet"; http_uri; content:"<!DOCTYPE"; http_client_body; content:"<!ENTITY"; http_client_body; content:"SYSTEM"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade GoCD to version 24.5.0 or later.
2. If upgrade is not possible, block access to /go/*/pipelines/snippet routes from external reverse proxy or WAF.
3. Implement network egress controls to prevent the GoCD server from making outbound connections to arbitrary destinations.

Long-term Measures:

1. Apply the principle of least privilege to group admin roles.
2. Regularly review and audit XML parsing configurations in all applications.
3. Implement input validation and sanitization for all XML inputs.
4. Use a Web Application Firewall (WAF) to filter malicious XML payloads.

Workarounds:

• Temporarily disable the pipeline snippet editing feature for group admins who do not need it.
• Use configuration repositories instead of direct XML editing.

Valters IT