CVE-2023-28629 (JavaScript, published 2023-03-27T21:15Z)
Description: value: GoCD is an open source continuous delivery server. GoCD versions before 23.1.0 are vulnerable to a stored XSS vulnerability, where pipeline configuration with a malicious pipeline label configuration can affect browser display of pipeline runs generated from that configuration. An attacker that has permissions to configure GoCD pipelines could include JavaScript elements within the label template, causing a XSS vulnerability to be triggered for any users viewing the Value Stream Map or Job Details for runs of the affected pipeline, potentially allowing them to perform arbitrary actions within the victim's browser context rather than their own. This issue has been fixed in GoCD 23.1.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/gocd/gocd
Files changed:
server/src/main/webapp/WEB-INF/rails/app/assets/javascripts/vsm_renderer.js
Commit message: Encode VSM node attributes for HTML


Vulnerable code:
                + '<p>' + instance.modified_time + '</p>'
                comment_markup = package_comment + "<br/>";
                return comment_markup + "Trackback: " + "<a href=" + trackback_url + ">" + trackback_url + "</a>";
                comment_tooltip = package_comment + "\n";
                return comment_tooltip + "Trackback: " + trackback_url;
            gui += '<div class="message restricted"><span>' + node.message + '</span></div>';
            gui += '<div class="warning"><span>' + node.message + '</span></div>';
            gui += '<div class="message deleted"><span>' + node.message + '</span></div>';
                gui += '<h4 title="' + instance.label + '"><span class="pipeline_run_label">Instance: ' + instance.label + '</span></h4>';
                gui += '<h4 title="' + instance.label + '"><span class="pipeline_run_label">Instance: ' + instance.label + '</span><span class="vsm_link_wrapper"><a href="' + instance.locator + '">' + 'VSM' + '</a></span></h4>';

Fixed code:
                + '<p>' + _.escape(instance.modified_time) + '</p>'
                comment_markup = _.escape(package_comment) + "<br/>";
                return comment_markup + "Trackback: " + "<a href=" + _.escape(trackback_url) + ">" + _.escape(trackback_url) + "</a>";
                comment_tooltip = _.escape(package_comment) + "\n";
                return comment_tooltip + "Trackback: " + _.escape(trackback_url);
            gui += '<div class="message restricted"><span>' + _.escape(node.message) + '</span></div>';
            gui += '<div class="warning"><span>' + _.escape(node.message) + '</span></div>';
            gui += '<div class="message deleted"><span>' + _.escape(node.message) + '</span></div>';
                gui += '<h4 title="' + _.escape(instance.label) + '"><span class="pipeline_run_label">Instance: ' + _.escape(instance.label) + '</span></h4>';
                gui += '<h4 title="' + _.escape(instance.label) + '"><span class="pipeline_run_label">Instance: ' + _.escape(instance.label) + '</span><span class="vsm_link_wrapper"><a href="' + instance.locator + '">' + 'VSM' + '</a></span></h4>';