CVE-2024-56324: Thoughtworks GoCD XXE Vulnerability

CVE-2024-56324 Overview

GoCD is a continuous delivery server maintained by Thoughtworks. CVE-2024-56324 affects GoCD versions prior to 24.5.0 and allows users with the "group admin" role to trigger XML External Entity (XXE) injection [CWE-611] on the GoCD server. The flaw exists because the raw XML configuration editor for pipeline groups parses input without disabling external entity resolution. Authenticated group administrators can abuse this capability to reach XML parsing paths that resolve attacker-controlled entities on the server side.

Critical Impact
Authenticated group administrators can potentially leverage XXE to conduct Server-Side Request Forgery (SSRF), read files from the GoCD server, and perform directory traversal, though these secondary attacks were not explicitly demonstrated.

Affected Products

Thoughtworks GoCD versions prior to 24.5.0
GoCD server instances exposing the /go/*/pipelines/snippet route
GoCD deployments with delegated "group admin" trust boundaries

Discovery Timeline

2025-01-03 - CVE-2024-56324 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-56324

Vulnerability Analysis

GoCD allows privileged users to edit pipeline group configuration as raw XML through the /go/*/pipelines/snippet route. The underlying XML parser, built on org.jdom2.input.SAXBuilder, did not consistently reject DOCTYPE declarations or external entity resolution. An attacker with group admin privileges can submit crafted XML containing external entity references. When the server parses the snippet, the XML processor resolves those entities, exposing server-side resources to the attacker.

The issue crosses a trust boundary: GoCD's role model treats "group admin" as scoped to a specific pipeline group, but the XXE flaw grants that role read access to arbitrary server resources reachable by the GoCD process. This includes local files, internal HTTP endpoints, and cloud metadata services if network egress is not restricted.

Root Cause

The root cause is the use of a SAXBuilder derivative (ValidatingSaxBuilder) that did not enforce a strict deny-list for DOCTYPE declarations and external entities across all XML parsing paths. The upstream fix refactors XML parsing onto a shared SafeSaxBuilder utility and moves validation from DTD-based to XSD-based schema handling.

Attack Vector

Exploitation requires an authenticated GoCD user holding the group admin role for at least one pipeline group. The attacker submits malicious XML via the pipeline snippet editor. The server parses the payload and resolves external entities under the GoCD process context, returning results or triggering outbound requests.

java

// Security patch: ValidatingSaxBuilder.java
// Source: https://github.com/gocd/gocd/commit/410331a97eb2935e04c1372f50658e05c533f733
 package com.thoughtworks.go.util;

-import org.jdom2.input.SAXBuilder;
 import org.jdom2.input.sax.XMLReaders;

 import java.net.URISyntaxException;
 import java.net.URL;

-class ValidatingSaxBuilder extends SAXBuilder {
+class ValidatingSaxBuilder extends SafeSaxBuilder {
     public ValidatingSaxBuilder() {
+        super();
         this.setFeature("http://apache.org/xml/features/validation/schema", true);
-        this.setXMLReaderFactory(XMLReaders.DTDVALIDATING);
-        this.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+        this.setXMLReaderFactory(XMLReaders.XSDVALIDATING);
     }

-    public ValidatingSaxBuilder(URL resource) throws URISyntaxException {
+    public ValidatingSaxBuilder(URL schemaLocation) throws URISyntaxException {
         this();
-        this.setProperty("http://apache.org/xml/properties/schema/external-noNamespaceSchemaLocation", resource.toURI().toString());
+        this.setProperty("http://apache.org/xml/properties/schema/external-noNamespaceSchemaLocation", schemaLocation.toURI().toString());
     }
 }

The patch consolidates parsing on SafeSaxBuilder, which centralizes secure defaults including entity resolution controls. See the GitHub commit 410331a for the full change set.

Detection Methods for CVE-2024-56324

Indicators of Compromise

HTTP POST or PUT requests to /go/*/pipelines/snippet containing <!DOCTYPE or <!ENTITY markers in the request body.
Outbound network connections from the GoCD server process to unexpected internal hosts or cloud metadata endpoints such as 169.254.169.254.
Unusual file read activity by the GoCD JVM against system files like /etc/passwd or configuration directories outside the GoCD data path.

Detection Strategies

Inspect reverse proxy or WAF logs for XML payloads containing DOCTYPE or SYSTEM keywords targeting the pipeline snippet endpoint.
Correlate group admin authentication events with subsequent XML edit actions and outbound server connections.
Baseline expected outbound destinations from the GoCD server and alert on deviations.

Monitoring Recommendations

Enable audit logging for GoCD configuration edits and track which principals invoke the pipeline snippet API.
Monitor the GoCD server host for anomalous file reads and DNS resolutions initiated by the Java process.
Ingest GoCD access logs into a centralized analytics platform for retention and correlation with network telemetry.

How to Mitigate CVE-2024-56324

Immediate Actions Required

Upgrade GoCD to version 24.5.0 or later, which contains the fix from commit 410331a.
Audit the list of accounts holding the "group admin" role and remove unnecessary assignments.
Review recent activity on /go/*/pipelines/snippet for suspicious XML payloads.

Patch Information

Thoughtworks resolved this issue in GoCD 24.5.0. The security fix is described in GHSA-3w9f-fgr5-5g78 and implemented in commit 410331a, which consolidates XML parsing behind a SafeSaxBuilder utility.

Workarounds

Block access to /go/*/pipelines/snippet at an upstream reverse proxy or WAF if group admins do not need raw XML editing.
Enforce egress network controls on the GoCD server to prevent outbound connections to arbitrary destinations, including cloud metadata services.
Require configuration changes to flow through a configuration repository or the UI rather than the raw XML editor.

bash

# Example NGINX reverse proxy block for the vulnerable route
location ~* ^/go/.*/pipelines/snippet {
    return 403;
}

# Verify the running GoCD version
curl -sk https://gocd.example.com/go/api/version | jq .