CVE-2024-56321

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-56321
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-56321.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-56321
Aliases
  • GHSA-7jr3-gh3w-vjxq
Published
2025-01-03T15:41:40.737Z
Modified
2026-07-22T03:35:52.454953Z
Severity
  • 3.8 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
GoCD can allow malicious GoCD admins to abuse backup configuration to gain additional host access
Details

GoCD is a continuous deliver server. GoCD versions 18.9.0 through 24.4.0 (inclusive) can allow GoCD admins to abuse the backup configuration "post-backup script" feature to potentially execute arbitrary scripts on the hosting server or container as GoCD's user, rather than pre-configured scripts. In practice the impact of this vulnerability is limited, as in most configurations a user who can log into the GoCD UI as an admin also has host administration permissions for the host/container that GoCD runs on, in order to manage artifact storage and other service-level configuration options. Additionally, since a GoCD admin has ability to configure and schedule pipelines tasks on all GoCD agents available to the server, the fundamental functionality of GoCD allows co-ordinated task execution similar to that of post-backup-scripts. However in restricted environments where the host administration is separated from the role of a GoCD admin, this may be unexpected. The issue is fixed in GoCD 24.5.0. Post-backup scripts can no longer be executed from within certain sensitive locations on the GoCD server. No known workarounds are available.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56321.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-20",
        "CWE-36"
    ]
}
References

Affected packages

Git / github.com/gocd/gocd

Affected ranges

Type
GIT
Repo
https://github.com/gocd/gocd
Events
Introduced
f202ea9416939d7ce356cf3939239ef953ec423b
Fixed
8f7bf5297c90c909e42d030baad54a1d32701c65
Fixed
631f315d17fcb73f310eee6c881974c9b55ca9f0
Database specific 
{
    "cpe": "cpe:2.3:a:thoughtworks:gocd:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "18.9.0"
        },
        {
            "fixed": "24.5.0"
        }
    ]
}

Affected versions

18.*
18.10.0
18.11.0
18.12.0
18.9.0
19.*
19.1.0
19.10.0
19.11.0
19.12.0
19.2.0
19.3.0
19.4.0
19.5.0
19.6.0
19.7.0
19.8.0
19.9.0
20.*
20.1.0
20.10.0
20.2.0
20.3.0
20.4.0
20.5.0
20.6.0
20.7.0
20.8.0
20.9.0
21.*
21.1.0
21.2.0
21.3.0
21.4.0
22.*
22.1.0
22.2.0
22.3.0
23.*
23.1.0
23.2.0
23.3.0
23.4.0
23.5.0
24.*
24.1.0
24.2.0
24.3.0
24.4.0

Database specific

vanir_signatures 
[
    {
        "digest": {
            "length": 1177.0,
            "function_hash": "169423959244440645033991206526920870343"
        },
        "signature_version": "v1",
        "source": "https://github.com/gocd/gocd/commit/631f315d17fcb73f310eee6c881974c9b55ca9f0",
        "signature_type": "Function",
        "target": {
            "function": "shouldNotSendEmailToAdminWhenTheBackupFailsAndEmailConfigIsNotSet",
            "file": "server/src/test-integration/java/com/thoughtworks/go/server/service/BackupServiceIntegrationTest.java"
        },
        "id": "CVE-2024-56321-0a1a9682",
        "deprecated": false
    },
    {
        "digest": {
            "length": 310.0,
            "function_hash": "138459988591685333563257840597330326497"
        },
        "signature_version": "v1",
        "source": "https://github.com/gocd/gocd/commit/631f315d17fcb73f310eee6c881974c9b55ca9f0",
        "signature_type": "Function",
        "target": {
            "function": "BackupService",
            "file": "server/src/main/java/com/thoughtworks/go/server/service/BackupService.java"
        },
        "id": "CVE-2024-56321-11da9dc2",
        "deprecated": false
    },
    {
        "digest": {
            "length": 102.0,
            "function_hash": "48460021866969876079162519880783302983"
        },
        "signature_version": "v1",
        "source": "https://github.com/gocd/gocd/commit/631f315d17fcb73f310eee6c881974c9b55ca9f0",
        "signature_type": "Function",
        "target": {
            "function": "cleanupBackups",
            "file": "server/src/test-integration/java/com/thoughtworks/go/server/service/BackupServiceIntegrationTest.java"
        },
        "id": "CVE-2024-56321-1bcffb0f",
        "deprecated": false
    },
    {
        "digest": {
            "length": 1129.0,
            "function_hash": "209366827235907316000615629614736820864"
        },
        "signature_version": "v1",
        "source": "https://github.com/gocd/gocd/commit/631f315d17fcb73f310eee6c881974c9b55ca9f0",
        "signature_type": "Function",
        "target": {
            "function": "shouldExecutePostBackupScriptAndReturnResultOnSuccess",
            "file": "server/src/test-integration/java/com/thoughtworks/go/server/service/BackupServiceIntegrationTest.java"
        },
        "id": "CVE-2024-56321-1e405777",
        "deprecated": false
    },
    {
        "digest": {
            "length": 1452.0,
            "function_hash": "145785137803911864586803869221985523895"
        },
        "signature_version": "v1",
        "source": "https://github.com/gocd/gocd/commit/631f315d17fcb73f310eee6c881974c9b55ca9f0",
        "signature_type": "Function",
        "target": {
            "function": "shouldSendEmailToAdminWhenTheBackupFails",
            "file": "server/src/test-integration/java/com/thoughtworks/go/server/service/BackupServiceIntegrationTest.java"
        },
        "id": "CVE-2024-56321-3cfd5fb2",
        "deprecated": false
    },
    {
        "digest": {
            "length": 93.0,
            "function_hash": "28363217483609477990257254543349270301"
        },
        "signature_version": "v1",
        "source": "https://github.com/gocd/gocd/commit/631f315d17fcb73f310eee6c881974c9b55ca9f0",
        "signature_type": "Function",
        "target": {
            "function": "MessageCollectingBackupUpdateListener",
            "file": "server/src/test-integration/java/com/thoughtworks/go/server/service/BackupServiceIntegrationTest.java"
        },
        "id": "CVE-2024-56321-42635458",
        "deprecated": false
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "131365351317802087008710286564617579346",
                "195360278436378185448783503025062639324",
                "230272028314715839047048136640814400509",
                "322563258582849285810762324130504250002",
                "186885185133549772174366658625376910194",
                "175784495665384252586523085577101170113",
                "205106794206691459252780456443348853758",
                "195385770997638734104581857293768543389",
                "60428758532226083879564012875783315739",
                "43641195754711423880188335207893478790",
                "235142224938606934060524928743365214368",
                "136661292335496712413341858748683780560",
                "152990490717793748733716050662838937934",
                "246852434839781659925955787124963984284",
                "8717269674827870708415777906931155955",
                "45012203338604334686328030298724311165",
                "145097357323477765263499024353956434390",
                "323797779882315336667524571286108625055",
                "326858609996555533791714306777773745137",
                "59952307218965383136053860656460256140",
                "58375820677709199296133853104505815569",
                "89463095016663382928228287134547502667",
                "274587657825021736489093170217598984603",
                "141754030223339106923741479757324576529",
                "72428519832481216433785601692605338132",
                "326858609996555533791714306777773745137",
                "102042542664385951211767700706021437409",
                "141227791428293643178954600313084531082",
                "87929605415000621727384224372958386303",
                "61077428349755488155820410981010499734",
                "227334191746808640140787643734671666826",
                "289151688696516630348257425205765905397",
                "325794775160599340980200737933717027573",
                "23429866694913346183926605387077587896",
                "229976139921923822697337390044255469669",
                "168965500545046796282688859127723637247",
                "221049450438832599718667039165032722862",
                "326566103194560154518635797567659842991",
                "119139500950807135007129062572070512103",
                "17700812522064795158028898400283492226",
                "94847052838334425878681272032065703272",
                "330349722272249746991827687202566827138",
                "54425609439946948915355627232143818550",
                "109296803042428098405482543667019329975",
                "244063477395336899636356931203383941576",
                "42885948522791535009033569226240125610",
                "305053321361229454495263527362756029933",
                "122636690669534843571766205265701169664",
                "183803778744626505886181375634735604883",
                "305789975149314136632538704284405309945",
                "323448366710316584685704197430574125143",
                "327654373719569346516164339273163299429",
                "278173359233513901290632120845344674313",
                "284456766279776112910749774451813801728"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/gocd/gocd/commit/631f315d17fcb73f310eee6c881974c9b55ca9f0",
        "signature_type": "Line",
        "target": {
            "file": "server/src/test-integration/java/com/thoughtworks/go/server/service/BackupServiceIntegrationTest.java"
        },
        "id": "CVE-2024-56321-445f8b1e",
        "deprecated": false
    },
    {
        "digest": {
            "length": 40.0,
            "function_hash": "271830196785110785498745910183895838807"
        },
        "signature_version": "v1",
        "source": "https://github.com/gocd/gocd/commit/631f315d17fcb73f310eee6c881974c9b55ca9f0",
        "signature_type": "Function",
        "target": {
            "function": "getMessages",
            "file": "server/src/test-integration/java/com/thoughtworks/go/server/service/BackupServiceIntegrationTest.java"
        },
        "id": "CVE-2024-56321-4cc9b76b",
        "deprecated": false
    },
    {
        "digest": {
            "length": 1084.0,
            "function_hash": "42359742624560157578584392536781473658"
        },
        "signature_version": "v1",
        "source": "https://github.com/gocd/gocd/commit/631f315d17fcb73f310eee6c881974c9b55ca9f0",
        "signature_type": "Function",
        "target": {
            "function": "performBackup",
            "file": "server/src/main/java/com/thoughtworks/go/server/service/BackupService.java"
        },
        "id": "CVE-2024-56321-b2f6f203",
        "deprecated": false
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "241815901407656467530973540401208390080",
                "80707376781117994614477842153355905314",
                "223572452070470611391685247771738411630",
                "151857952082872319570946432324679100231",
                "113525373903602762832975707967520571738",
                "235378635840376660188664131150511772530",
                "330854160151910622102505887060093710092",
                "244098717026791067192178987176647095982",
                "242313128459804670882266032033903101255",
                "242696130290329906501681394704499782600",
                "209310624859107338400960323233269200992",
                "208570423229172557936481128115186102024"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/gocd/gocd/commit/631f315d17fcb73f310eee6c881974c9b55ca9f0",
        "signature_type": "Line",
        "target": {
            "file": "server/src/main/java/com/thoughtworks/go/server/service/BackupService.java"
        },
        "id": "CVE-2024-56321-cc6e88f8",
        "deprecated": false
    }
]
vanir_signatures_modified 
"2026-07-22T03:35:52Z"
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-56321.json"