[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-Id: <4418E151-21FE-42EE-ACC8-B75A99AC469E@beckweb.net>
Date: Tue, 19 Feb 2019 19:33:19 +0100
From: Daniel Beck <ml@...kweb.net>
To: oss-security@...ts.openwall.com
Subject: Multiple vulnerabilities in Jenkins plugins
Jenkins is an open source automation server which enables developers around
the world to reliably build, test, and deploy their software. The following
releases contain fixes for security vulnerabilities:
* Acunetix Plugin 1.1.0
* Arxan MAM Publisher Plugin 2.0
* Cloud Foundry Plugin 2.3.2
* ElectricFlow Plugin 1.1.5
* JMS Messaging Plugin 1.1.2
* Mattermost Notification Plugin 2.6.3
* OctopusDeploy Plugin 1.9.0
* Script Security Plugin 1.53
Summaries of the vulnerabilities are below. More details, severity, and
attribution can be found here:
https://jenkins.io/security/advisory/2019-02-19/
We provide advance notification for security updates on this mailing list:
https://groups.google.com/d/forum/jenkinsci-advisories
If you discover security vulnerabilities in Jenkins, please report them as
described here:
https://jenkins.io/security/#reporting-vulnerabilities
---
SECURITY-1320
The previously implemented Script Security Plugin sandbox protections
prohibiting the use of unsafe AST transforming annotations such as @Grab
could be circumvented through use of various Groovy language features:
* Using Groovy’s AnnotationCollector
* Import aliasing
* Referencing annotation types using their full class name
This allowed users with Overall/Read permission, or the ability to control
Jenkinsfile or sandboxed Pipeline shared library contents in SCM, to
bypass the sandbox protection and execute arbitrary code on the Jenkins
master.
Using AnnotationCollector is now newly prohibited in sandboxed scripts
such as Pipelines. Importing any of the annotations considered unsafe will
now result in an error. During the compilation phase, both simple and
full class names of prohibited annotations are rejected for element
annotations.
SECURITY-876
Cloud Foundry Plugin did not perform permission checks on a method
implementing form validation. This allowed users with Overall/Read access
to Jenkins to connect to an attacker-specified URL using attacker-
specified credentials IDs obtained through another method, capturing
credentials stored in Jenkins.
Additionally, this form validation method did not require POST requests,
resulting in a cross-site request forgery vulnerability.
SECURITY-985
A missing permission check in a form validation method in Mattermost
Notification Plugin allowed users with Overall/Read permission to
initiate a connection test, connecting to an attacker-specified
Mattermost server and room and posting a message.
Additionally, this form validation method did not require POST requests,
resulting in a CSRF vulnerability.
SECURITY-817
A missing permission check in a form validation method in OctopusDeploy
Plugin allowed users with Overall/Read permission to initiate a
connection test, sending an HTTP HEAD request to an attacker-specified
URL, returning HTTP response code if successful, or exception error
message otherwise.
Additionally, this form validation method did not require POST requests,
resulting in a CSRF vulnerability.
SECURITY-1033
A missing permission check in a form validation method in JMS Messaging
Plugin allowed users with Overall/Read permission to initiate a
connection test, sending an HTTP request to an attacker-specified URL.
Additionally, this form validation method did not require POST requests,
resulting in a CSRF vulnerability.
SECURITY-937
ElectricFlow Plugin unconditionally disabled SSL/TLS certificate
validation for the entire Jenkins master JVM.
SECURITY-951
Acunetix Plugin stored the API Key in its configuration unencrypted in
its global configuration file on the Jenkins master. This key could be
viewed by users with access to the master file system.
SECURITY-980
A missing permission check in a form validation method in Acunetix Plugin
allowed users with Overall/Read permission to initiate a connection test,
sending an HTTP GET request to an attacker-specified URL, adding a /me
suffix, returning whether the connection could be established and whether
the HTTP response code is 200.
Additionally, this form validation method did not require POST requests,
resulting in a CSRF vulnerability.
SECURITY-1070
Arxan MAM Publisher Plugin stored the username and password connection
credentials in its configuration unencrypted in jobs' config.xml files on
the Jenkins master. This key could be viewed by users with Extended Read
permission, or access to the master file system.
While masked from view using a password form field, the password was
transferred in plain text to users when accessing the job configuration
form.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
