CVE-2023-28629 Stored XSS possible on VSM and Job Details pages via malicious pipeline label configuration in gocd
An attacker with pipeline configuration permissions can inject malicious JavaScript into pipeline labels, leading to stored XSS and potential account takeover for users viewing specific pages.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-28629?
CVE-2023-28629 is a medium-severity cross-site scripting vulnerability in gocd, published on 27 Mar 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
GoCD is an open source continuous delivery server. GoCD versions before 23.1.0 are vulnerable to a stored XSS vulnerability, where pipeline configuration with a malicious pipeline label configuration can affect browser display of pipeline runs generated from that configuration. An attacker that has permissions to configure GoCD pipelines could include JavaScript elements within the label template, causing a XSS vulnerability to be triggered for any users viewing the Value Stream Map or Job Details for runs of the affected pipeline, potentially allowing them to perform arbitrary actions within the victim's browser context rather than their own. This issue has been fixed in GoCD 23.1.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Weakness: CWE-79
Which versions are affected by CVE-2023-28629?
It affects 1 product.
Products include Thoughtworks Gocd.
How do I fix CVE-2023-28629?
No fix has been published for CVE-2023-28629 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-28629 being exploited?
There is no known exploitation of CVE-2023-28629 in the wild and no public exploit code.
Other vulnerabilities in gocd
- CVE-2021-43290 Path traversal in n/a
- CVE-2021-44659 Server-side request forgery in n/a
- CVE-2024-56320 GoCD vulnerable to admin privilege escalation by a malicious internal/existing authenticated user
- CVE-2022-39311 Compromised agents may be able to execute remote code on GoCD Server
- CVE-2022-29184 Command Injection/Argument Injection in GoCD
Sources
Also known as GHSA-3vvg-gjfr-q9vm.