CVE-2024-56324: 
GoCD Server vulnerability analysis and mitigation

GoCD is a continuous delivery server. In versions prior to 24.4.0, GoCD "group admins" could abuse their ability to edit the raw XML configuration for groups they administer to trigger XML External Entity (XXE) injection on the GoCD server. The vulnerability was discovered in January 2025 and was fixed in GoCD version 24.5.0 (GitHub Advisory).

The vulnerability is classified as an XML External Entity (XXE) injection vulnerability (CWE-611). The issue has a CVSS v4.0 base score of 2.1 (Low) with the vector string CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. The vulnerability could theoretically result in additional attacks such as SSRF, information disclosure from the GoCD server, and directory traversal, although these additional attacks have not been explicitly demonstrated as exploitable (GitHub Advisory).

The vulnerability allows group administrators to potentially access sensitive information from the GoCD server through XXE injection. While the direct impact is limited to information disclosure, the vulnerability could theoretically enable Server-Side Request Forgery (SSRF) and directory traversal attacks, though these have not been proven exploitable (GitHub Advisory).

The vulnerability has been fixed in GoCD version 24.5.0. For users unable to upgrade immediately, two workarounds are available: 1) Temporarily block access to /go/*/pipelines/snippet routes from an external reverse proxy or WAF if group admin users don't need the functionality to edit XML of pipelines directly, or 2) Prevent external access from the GoCD server to arbitrary locations using environment egress control (GitHub Advisory, GoCD Release).