[<prev] [next>] [day] [month] [year] [list]
Message-Id: <2AB17EF3-293D-4D08-BA20-9452BE683E95@beckweb.net>
Date: Tue, 25 Sep 2018 17:18:00 +0200
From: Daniel Beck <ml@...kweb.net>
To: oss-security@...ts.openwall.com
Subject: Multiple vulnerabilities in Jenkins plugins
Jenkins is an open source automation server which enables developers around
the world to reliably build, test, and deploy their software. The following
releases contain fixes for security vulnerabilities:
* Arachni Scanner Plugin 1.0.0
* Argus Notifier Plugin 1.0.2
* Artifactory Plugin 2.16.2
* Chatter Notifier Plugin 2.0.5
* Config File Provider Plugin 3.2
* Crowd 2 Integration Plugin 2.0.1
* Dimensions Plugin 0.8.15
* Email Extension Template Plugin 1.1
* Git Changelog Plugin 2.7
* HipChat Plugin 2.2.1
* JIRA Plugin 3.0.2
* Job Configuration History Plugin 2.18.1
* JUnit Plugin 1.26
* mesos Plugin 0.18
* Monitoring Plugin 1.74.0
* MQ Notifier Plugin 1.2.7
* PAM Authentication Plugin 1.4
* Publish Over Dropbox Plugin 1.2.5
* Rebuilder Plugin 1.29
* SonarQube Scanner Plugin 2.8.1
Additionally, these plugin have security vulnerabilities that have been made
public, but have no releases containing a fix yet:
* Metadata Plugin
Summaries of the vulnerabilities are below. More details, severity, and
attribution can be found here:
https://jenkins.io/security/advisory/2018-09-25/
We provide advance notification for security updates on this mailing list:
https://groups.google.com/d/forum/jenkinsci-advisories
If you discover security vulnerabilities in Jenkins, please report them as
described here:
https://jenkins.io/security/#reporting-vulnerabilities
---
SECURITY-1101
A URL used to allow setting the description of a test object in JUnit
Plugin did not require POST requests, resulting in a cross-site request
forgery vulnerability.
SECURITY-1029
Jira Plugin did not perform permission checks on a method implementing form
validation. This allowed users with Overall/Read access to Jenkins to
connect to an attacker-specified URL using attacker-specified credentials
IDs obtained through another method, capturing credentials stored in Jenkins.
Additionally, this form validation method did not require POST requests,
resulting in a cross-site request forgery vulnerability.
SECURITY-1080
Config File Provider Plugin did not escape configuration file metadata,
resulting in a stored cross-site scripting (XSS) vulnerability.
SECURITY-938
A URL used to save configuration files based on form submissions in Config
File Provider Plugin did not require POST requests, resulting in a CSRF
vulnerability.
SECURITY-130
Rebuild Plugin did not escape parameter descriptions shown on the rebuild
form page, resulting in a stored Cross-Site Scripting (XSS) vulnerability
exploitable by users with the permission to configure jobs.
SECURITY-1130
Job Config History Plugin did not escape some query parameters shown on its
pages, resulting in a reflected cross-site scripting (XSS) vulnerability.
SECURITY-1125
Some URLs implementing form submission handling in Email Extension Template
Plugin did not require POST requests, resulting in a CSRF vulnerability
that allowed attackers to create or remove templates.
SECURITY-984 (1)
HipChat Plugin did not perform permission checks on a method that sends
test notifications. This allowed users with Overall/Read access to Jenkins
to connect to an attacker-specified HipChat server using attacker-specified
connection settings and credentials IDs obtained through another method,
capturing credentials stored in Jenkins, and submitting messages to HipChat.
Additionally, this form validation method did not require POST requests,
resulting in a cross-site request forgery vulnerability.
SECURITY-984 (2)
HipChat Plugin provides a list of applicable credential IDs to allow
administrators configuring the plugin to select the one to use.
This functionality did not check permissions, allowing any user with
Overall/Read permission to get a list of valid credentials IDs. Those could
be used as part of an attack to capture the credentials using another
vulnerability.
SECURITY-1013 (1)
Mesos Plugin provides a list of applicable credential IDs to allow
administrators configuring the Mesos cloud to select the one to use.
This functionality did not check permissions, allowing any user with
Overall/Read permission to get a list of valid credentials IDs. Those could
be used as part of an attack to capture the credentials using another
vulnerability.
SECURITY-1013 (2)
A missing permission check in a form validation method in Mesos Plugin
allowed users with Overall/Read permission to initiate a connection test,
connecting to an attacker-specified URL.
Additionally, this form validation method did not require POST requests,
resulting in a CSRF vulnerability.
SECURITY-1067
Crowd 2 Integration Plugin did not perform permission checks on a method
implementing form validation. This allowed users with Overall/Read access
to Jenkins to connect to an attacker-specified URL with attacker-specified
credentials and connection settings.
Additionally, this form validation method did not require POST requests,
resulting in a CSRF vulnerability.
SECURITY-1068
Crowd 2 Integration Plugin stored the Crowd password unencrypted in its
global configuration file on the Jenkins master. This password could be
viewed by users with access to the master file system.
SECURITY-972
Users with Overall/Read permission were able to access MQ Notifier Plugin’s
form validation URL, having it connect to an attacker-specified MQ system
with attacker-specified credentials.
Additionally, this form validation URL did not require POST requests,
resulting in a CSRF vulnerability.
SECURITY-1075
A stored cross-site scripting (XSS) vulnerability in Metadata Plugin allows
users with permission to change metadata definitions to insert arbitrary
HTML/Javascript into Jenkins pages.
SECURITY-1135
Metadata Plugin lacks a permission check that allows users with
Overall/Read access to Jenkins to change the plugin’s configuration.
SECURITY-265
Artifactory Plugin 2.4.0 introduced support for securely storing
credentials using the Credentials Plugin. Old, insecurely stored
credentials however were not removed when switching to this new system.
SECURITY-813 / CVE-2017-12197
The pam4j library bundled in PAM Authentication Plugin had a bug that
resulted in it not properly validating user accounts.
SECURITY-1163
SonarQube Scanner Plugin stored a server authentication token unencrypted
in its global configuration file on the Jenkins master. This token could be
viewed by users with access to the master file system.
SECURITY-1122
Git Changelog Plugin did not escape the Git commit messages it displayed
since version 1.48, resulting in a stored cross-site scripting (XSS)
vulnerability exploitable by users with commit access to specific Git
repositories.
SECURITY-948
Arachni Scanner Plugin stored its password unencrypted in its global
configuration file on the Jenkins master. This password could be viewed by
users with access to the master file system.
SECURITY-1011 (1)
Argus Notifier Plugin did not perform permission checks on a method
implementing form validation. This allowed users with Overall/Read access
to Jenkins to connect to an attacker-specified URL using attacker-specified
credentials IDs obtained through another method, capturing credentials
stored in Jenkins.
Additionally, this form validation method did not require POST requests,
resulting in a cross-site request forgery vulnerability.
SECURITY-1011 (2)
Argus Notifier Plugin provides a list of applicable credential IDs to allow
administrators configuring the plugin to select the one to use.
This functionality did not check permissions, allowing any user with
Overall/Read permission to get a list of valid credentials IDs. Those could
be used as part of an attack to capture the credentials using another
vulnerability.
SECURITY-1050 (1)
Chatter Notifier Plugin did not perform permission checks on a method
implementing form validation. This allowed users with Overall/Read access
to Jenkins to connect to an attacker-specified URL using attacker-specified
credentials IDs obtained through another method, capturing credentials
stored in Jenkins.
Additionally, this form validation method did not require POST requests,
resulting in a cross-site request forgery vulnerability.
SECURITY-1050 (2)
Chatter Notifier Plugin provides a list of applicable credential IDs to
allow users configuring the plugin’s functionality to select the one to use.
This functionality did not check permissions, allowing any user with
Overall/Read permission to get a list of valid credentials IDs. Those could
be used as part of an attack to capture the credentials using another
vulnerability.
SECURITY-1065
Dimensions Plugin stored a password unencrypted in its global configuration
file on the Jenkins master. This password could be viewed by users with
access to the master file system.
SECURITY-1108
Users with Overall/Read permission were able to access Dimensions Plugin’s
form validation URL, having it connect to an attacker-specified Dimensions
system with attacker-specified credentials.
Additionally, this form validation URL did not require POST requests,
resulting in a CSRF vulnerability.
SECURITY-845
Publish Over Dropbox Plugin stored authorization code and access code
unencrypted in its global configuration file on the Jenkins master. These
secrets could be viewed by users with access to the master file system.
Additionally, the authorization code was not masked from view using a
password form field.
SECURITY-1156 / CVE-2018-15531
The JavaMelody library bundled in Monitoring Plugin is affected by an XML
External Entity (XXE) processing vulnerability.
This allows attacker to send crafted requests to a web application for
extraction of secrets from the file system, server-side request forgery, or
denial-of-service attacks.
Monitoring plugin 1.74 updates its JavaMelody dependency to fix the issue.
The Jenkins security team and the maintainer of Monitoring Plugin have been
unable to reproduce the issue in Jenkins, but we still recommend updating.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
