{"id":"CVE-2024-56321","summary":"GoCD can allow malicious GoCD admins to abuse backup configuration to gain additional host access","details":"GoCD is a continuous deliver server. GoCD versions 18.9.0 through 24.4.0 (inclusive) can allow GoCD admins to abuse the backup configuration \"post-backup script\" feature to potentially execute arbitrary scripts on the hosting server or container as GoCD's user, rather than pre-configured scripts. In practice the impact of this vulnerability is limited, as in most configurations a user who can log into the GoCD UI as an admin also has host administration permissions for the host/container that GoCD runs on, in order to manage artifact storage and other service-level configuration options. Additionally, since a GoCD admin has ability to configure and schedule pipelines tasks on all GoCD agents available to the server, the fundamental functionality of GoCD allows co-ordinated task execution similar to that of post-backup-scripts. However in restricted environments where the host administration is separated from the role of a GoCD admin, this may be unexpected. The issue is fixed in GoCD 24.5.0. Post-backup scripts can no longer be executed from within certain sensitive locations on the GoCD server. No known workarounds are available.","aliases":["GHSA-7jr3-gh3w-vjxq"],"modified":"2026-08-12T14:52:21.337276Z","published":"2025-01-03T15:41:40.737Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-20","CWE-36"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56321.json"},"references":[{"type":"WEB","url":"https://github.com/gocd/gocd/releases/tag/24.5.0"},{"type":"WEB","url":"https://www.gocd.org/releases/#24-5-0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56321.json"},{"type":"ADVISORY","url":"https://github.com/gocd/gocd/security/advisories/GHSA-7jr3-gh3w-vjxq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56321"},{"type":"FIX","url":"https://github.com/gocd/gocd/commit/631f315d17fcb73f310eee6c881974c9b55ca9f0"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/gocd/gocd","events":[{"introduced":"f202ea9416939d7ce356cf3939239ef953ec423b"},{"fixed":"8f7bf5297c90c909e42d030baad54a1d32701c65"},{"fixed":"631f315d17fcb73f310eee6c881974c9b55ca9f0"}],"database_specific":{"cpe":"cpe:2.3:a:thoughtworks:gocd:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"18.9.0"},{"fixed":"24.5.0"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["24.4.0","24.3.0","24.2.0","24.1.0","23.5.0","23.4.0","23.3.0","23.2.0","23.1.0","22.3.0","22.2.0","22.1.0","21.4.0","21.3.0","21.2.0","21.1.0","20.10.0","20.9.0","20.8.0","20.7.0","20.6.0","20.5.0","20.4.0","20.3.0","20.2.0","20.1.0","19.12.0","19.11.0","19.10.0","19.9.0","19.8.0","19.7.0","19.6.0","19.5.0","19.4.0","19.3.0","19.2.0","19.1.0","18.12.0","18.11.0","18.10.0","18.9.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-56321.json","vanir_signatures_modified":"2026-08-12T14:52:21Z","vanir_signatures":[{"id":"CVE-2024-56321-0a1a9682","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/631f315d17fcb73f310eee6c881974c9b55ca9f0","target":{"function":"shouldNotSendEmailToAdminWhenTheBackupFailsAndEmailConfigIsNotSet","file":"server/src/test-integration/java/com/thoughtworks/go/server/service/BackupServiceIntegrationTest.java"},"deprecated":false,"digest":{"function_hash":"169423959244440645033991206526920870343","length":1177}},{"deprecated":false,"digest":{"function_hash":"138459988591685333563257840597330326497","length":310},"id":"CVE-2024-56321-11da9dc2","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/631f315d17fcb73f310eee6c881974c9b55ca9f0","target":{"file":"server/src/main/java/com/thoughtworks/go/server/service/BackupService.java","function":"BackupService"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/631f315d17fcb73f310eee6c881974c9b55ca9f0","target":{"file":"server/src/test-integration/java/com/thoughtworks/go/server/service/BackupServiceIntegrationTest.java","function":"cleanupBackups"},"deprecated":false,"digest":{"length":102,"function_hash":"48460021866969876079162519880783302983"},"id":"CVE-2024-56321-1bcffb0f"},{"deprecated":false,"digest":{"function_hash":"209366827235907316000615629614736820864","length":1129},"id":"CVE-2024-56321-1e405777","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/631f315d17fcb73f310eee6c881974c9b55ca9f0","target":{"file":"server/src/test-integration/java/com/thoughtworks/go/server/service/BackupServiceIntegrationTest.java","function":"shouldExecutePostBackupScriptAndReturnResultOnSuccess"}},{"target":{"file":"server/src/test-integration/java/com/thoughtworks/go/server/service/BackupServiceIntegrationTest.java","function":"shouldSendEmailToAdminWhenTheBackupFails"},"deprecated":false,"digest":{"function_hash":"145785137803911864586803869221985523895","length":1452},"id":"CVE-2024-56321-3cfd5fb2","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/631f315d17fcb73f310eee6c881974c9b55ca9f0"},{"digest":{"function_hash":"28363217483609477990257254543349270301","length":93},"id":"CVE-2024-56321-42635458","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/631f315d17fcb73f310eee6c881974c9b55ca9f0","target":{"file":"server/src/test-integration/java/com/thoughtworks/go/server/service/BackupServiceIntegrationTest.java","function":"MessageCollectingBackupUpdateListener"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/631f315d17fcb73f310eee6c881974c9b55ca9f0","target":{"file":"server/src/test-integration/java/com/thoughtworks/go/server/service/BackupServiceIntegrationTest.java"},"deprecated":false,"digest":{"line_hashes":["131365351317802087008710286564617579346","195360278436378185448783503025062639324","230272028314715839047048136640814400509","322563258582849285810762324130504250002","186885185133549772174366658625376910194","175784495665384252586523085577101170113","205106794206691459252780456443348853758","195385770997638734104581857293768543389","60428758532226083879564012875783315739","43641195754711423880188335207893478790","235142224938606934060524928743365214368","136661292335496712413341858748683780560","152990490717793748733716050662838937934","246852434839781659925955787124963984284","8717269674827870708415777906931155955","45012203338604334686328030298724311165","145097357323477765263499024353956434390","323797779882315336667524571286108625055","326858609996555533791714306777773745137","59952307218965383136053860656460256140","58375820677709199296133853104505815569","89463095016663382928228287134547502667","274587657825021736489093170217598984603","141754030223339106923741479757324576529","72428519832481216433785601692605338132","326858609996555533791714306777773745137","102042542664385951211767700706021437409","141227791428293643178954600313084531082","87929605415000621727384224372958386303","61077428349755488155820410981010499734","227334191746808640140787643734671666826","289151688696516630348257425205765905397","325794775160599340980200737933717027573","23429866694913346183926605387077587896","229976139921923822697337390044255469669","168965500545046796282688859127723637247","221049450438832599718667039165032722862","326566103194560154518635797567659842991","119139500950807135007129062572070512103","17700812522064795158028898400283492226","94847052838334425878681272032065703272","330349722272249746991827687202566827138","54425609439946948915355627232143818550","109296803042428098405482543667019329975","244063477395336899636356931203383941576","42885948522791535009033569226240125610","305053321361229454495263527362756029933","122636690669534843571766205265701169664","183803778744626505886181375634735604883","305789975149314136632538704284405309945","323448366710316584685704197430574125143","327654373719569346516164339273163299429","278173359233513901290632120845344674313","284456766279776112910749774451813801728"],"threshold":0.9},"id":"CVE-2024-56321-445f8b1e"},{"deprecated":false,"digest":{"function_hash":"271830196785110785498745910183895838807","length":40},"id":"CVE-2024-56321-4cc9b76b","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/631f315d17fcb73f310eee6c881974c9b55ca9f0","target":{"file":"server/src/test-integration/java/com/thoughtworks/go/server/service/BackupServiceIntegrationTest.java","function":"getMessages"}},{"deprecated":false,"digest":{"function_hash":"42359742624560157578584392536781473658","length":1084},"id":"CVE-2024-56321-b2f6f203","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/631f315d17fcb73f310eee6c881974c9b55ca9f0","target":{"file":"server/src/main/java/com/thoughtworks/go/server/service/BackupService.java","function":"performBackup"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/631f315d17fcb73f310eee6c881974c9b55ca9f0","target":{"file":"server/src/main/java/com/thoughtworks/go/server/service/BackupService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["241815901407656467530973540401208390080","80707376781117994614477842153355905314","223572452070470611391685247771738411630","151857952082872319570946432324679100231","113525373903602762832975707967520571738","235378635840376660188664131150511772530","330854160151910622102505887060093710092","244098717026791067192178987176647095982","242313128459804670882266032033903101255","242696130290329906501681394704499782600","209310624859107338400960323233269200992","208570423229172557936481128115186102024"]},"id":"CVE-2024-56321-cc6e88f8"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"}]}