GoCD: Imperfect CSRF To Overwrite Server Config at /go/admin/restful/configuration/file/POST/xml

The /go/admin/restful/configuration/file/POST/xml path is vulnerable to Cross-Site Request Forgery that can result in an unauthorized user adding to the server cruise-config.xml and gaining complete control of the server. Successful exploitation is made difficult by the need for the admin to be...

GoCD: Reflected XSS vector

Hello GoCD team, I noticed a reflected / stored XSS vulnerability vector that could potentially be used to impact security of GoCD users. - https://www.go.cd/user/upoad/..%2F..%2F - https://docs.go.cd/current/user/upoad/..%2F..%2F As you should see, this link is considered as valid by the HTTP...

GoCD: X-Content-Type-Options header missing at Auth Login

Hello Again, The doesn't have a header settings for X-Content-Type Options which means it is vulnerable to MIME sniffing. The only defined value, "nosniff", prevents Internet Explorer and Google Chrome from MIME-sniffing a response away from the declared content-type. This also applies to Google...

GoCD: Reflected XSS

Possible XSS when updating server configuration...

GoCD: Directory Listening

Hello Team, Found Directory Listening : http://IP:8153/go/NOTICE/ F105317 There is not usually any good reason to provide directory listings, and disabling them may place additional hurdles in the path of an attacker. This can normally be achieved in two ways: Configure your web server to prevent...

GoCD: Possible SSRF at URL Parameter while creating a new package repository

Possible SSRF vulnerability when creating a new package repository on GoCD...

GoCD: Cross Site Scripting

Possible XSS vulnerability when creating a new package repository on GoCD...

GoCD: XSS in http://localhost:8153/go/admin/config/server/update

Possible XSS when updating server configuration...