CVE-2024-56322: 
GoCD Server vulnerability analysis and mitigation

GoCD is a continuous deliver server affected by an XML External Entity (XXE) injection vulnerability in versions 16.7.0 through 24.4.0. The vulnerability allows GoCD administrators to abuse a hidden/unused configuration repository (pipelines as code) feature to trigger XXE injection on the GoCD Server. This occurs when GoCD periodically scans configuration repositories for pipeline updates, or when triggered by an administrator or config repo admin (GitHub Advisory).

The vulnerability is classified as CWE-611 (Improper Restriction of XML External Entity Reference). It has a CVSS v4.0 base score of 2.1 (LOW) with the following vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. The vulnerability requires high privileges (GoCD admin access) to exploit and has high attack complexity (NVD).

The impact of this vulnerability is limited in most cases without combining with another vulnerability, as only GoCD (super) admins have the ability to abuse it. A malicious GoCD admin can typically cause much larger damage through other means than through XXE injection (GitHub Advisory).

The vulnerability is fixed in GoCD version 24.5.0. As a workaround, users can prevent external access from the GoCD server to arbitrary locations using environment egress control (GitHub Advisory, GoCD Release Notes).