GoCD Backup Configuration Vulnerability Allowing Arbitrary Script Execution

A vulnerability in GoCD, a continuous delivery server, exists in versions 18.9.0 prior to 24.5.0. It allows GoCD admins to misuse the backup configuration's 'post-backup script' feature to execute arbitrary scripts on the hosting server or container as the GoCD user, instead of the pre-configured scripts. While this vulnerability could be exploited, its impact is generally limited. In most cases, a GoCD admin already has host administration permissions to manage artifact storage and service-level configurations. However, in environments where host and GoCD admin roles are separated, this vulnerability could lead to unexpected script execution.

Impact

Exploitation of this vulnerability could result in unauthorized script execution on the host server or container, potentially leading to further privilege escalation or unauthorized access to sensitive data, depending on the nature of the executed script.

Reproduction

To reproduce this vulnerability, a GoCD admin can configure a post-backup script in the GoCD backup settings. Once the script is set, it can be executed manually or scheduled to run after a backup process. The vulnerability can be exploited by placing a script in a location that is not monitored by GoCD, such as a custom directory, and then referencing it in the post-backup script configuration. When the backup process is completed, the referenced script will be executed on the host server or container as the GoCD user, allowing for arbitrary code execution.

Remediation

Users can upgrade to GoCD version 24.5.0 or later, where this vulnerability has been fixed. Instructions for upgrading can be found in the GoCD documentation.