CVE-2024-28866: 
GoCD Server vulnerability analysis and mitigation

GoCD versions from 19.4.0 to 23.5.0 (inclusive) are potentially vulnerable to a reflected cross-site scripting vulnerability (CVE-2024-28866) on the loading page displayed while GoCD is starting. The vulnerability was discovered in May 2024 and affects the GoCD continuous delivery server (GitHub Advisory).

The vulnerability exists due to inadequate validation of a redirect_to query parameter on the loading page that is displayed during server startup. This reflected XSS vulnerability could allow attackers to craft malicious links that, when opened by users during the server startup period, could potentially execute arbitrary JavaScript code in the user's browser (GitHub Advisory). The vulnerability has been assigned a CVSS v3.1 base score of 3.1 (LOW) with vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N (NVD).

The vulnerability could theoretically allow attackers to steal session tokens or other values from the user's browser. However, the practical impact is limited because any stolen session tokens would be invalidated once the server completes its restart, as GoCD does not support persistent sessions. Additionally, any executed XSS would occur within a logged-out context (GitHub Advisory).

The vulnerability has been fixed in GoCD version 24.1.0. For earlier versions, it is possible to work around the issue by overriding the loading page with an earlier non-vulnerable version using Java system property overrides: either -Dloading.page.resource.path=/loading_pages/default.loading.page.html for a simpler loading page, or -Dloading.page.resource.path=/does_not_exist.html to display a basic message without interactivity (GitHub Advisory).

The vulnerability was responsibly disclosed by Aviv Keller (RedYetiDev). The GoCD team acknowledged this as a theoretical vulnerability that has not shown to be practically exploitable (GoCD Release Notes).