CloudBees Security Advisory 2019-03-06
This advisory announces multiple vulnerabilities in Jenkins , CloudBees Jenkins Platform and CloudBees Jenkins Solutions .
Sandbox bypass in Script Security Plugin
SECURITY-1336 (1) / CVE-2019-1003029
Script Security sandbox protection could be circumvented during parsing, compilation, and script instantiation by providing a crafted Groovy script.
Script Security Plugin is now newly applying sandbox protection during these phases.
This affected both script execution (typically invoked from other plugins) as well as an HTTP endpoint providing script validation and allowed users with Overall/Read permission to bypass the sandbox protection and execute arbitrary code on the Jenkins master.
The API GroovySandbox#run(Script, Whitelist) has been deprecated and now emits a warning to the system log about potential security problems.GroovySandbox#run(GroovyShell, String, Whitelist) replaces it. GroovySandbox#checkScriptForCompilationErrors(String, GroovyClassLoader) has been added as a safer method to implement script validation.
Sandbox bypass in Pipeline: Groovy Plugin
SECURITY-1336 (2) / CVE-2019-1003030
Pipeline: Groovy sandbox protection could be circumvented during parsing, compilation, and script instantiation by providing a crafted Groovy script.
This allowed users able to control the contents of a pipeline to bypass the sandbox protection and execute arbitrary code on the Jenkins master.
Pipeline: Groovy Plugin now uses Script Security APIs that apply sandbox protection during these phases.
Script security sandbox bypass in Matrix Project Plugin
SECURITY-1339 / CVE-2019-1003031
Matrix Project Plugin supports a sandboxed Groovy expression to filter matrix combinations. Its sandbox protection could be circumvented during parsing, compilation, and script instantiation by providing a crafted Groovy script.
This allowed users able to configure a Matrix project to bypass the sandbox protection and execute arbitrary code on the Jenkins master.
Matrix Project Plugin now uses Script Security APIs that apply sandbox protection during these phases.
Script security sandbox bypass in Email Extension Plugin
SECURITY-1340 / CVE-2019-1003032
Email Extension Plugin supports sandboxed Groovy expressions for multiple features. Its sandbox protection could be circumvented during parsing, compilation, and script instantiation by providing a crafted Groovy script.
This allowed users able to control the plugin’s job-specific configuration to bypass the sandbox protection and execute arbitrary code on the Jenkins master.
Email Extension Plugin now uses Script Security APIs that apply sandbox protection during these phases.
Script security sandbox bypass in Groovy Plugin
SECURITY-1338 / CVE-2019-1003033
Groovy Plugin supports sandboxed Groovy expressions for its "System Groovy" functionality. Its sandbox protection could be circumvented during parsing, compilation, and script instantiation by providing a crafted Groovy script.
This affected both System Groovy script execution as well as an HTTP endpoint providing script validation, and allowed users with Overall/Read permission to bypass the sandbox protection and execute arbitrary code on the Jenkins master.
Groovy Plugin now uses Script Security APIs that apply sandbox protection during these phases.
Script security sandbox bypass in Job DSL Plugin
SECURITY-1342 / CVE-2019-1003034
Job DSL Plugin supports sandboxed Groovy expressions for Job DSL definitions. Its sandbox protection could be circumvented during parsing, compilation, and script instantiation by providing a crafted Groovy script.
This allowed users able to control the Job DSL scripts to bypass the sandbox protection and execute arbitrary code on the Jenkins master.
Job DSL Plugin now uses Script Security APIs that apply sandbox protection during these phases.
Information disclosure in Azure VM Agents Plugin
SECURITY-1330 / CVE-2019-1003035
A missing permission check in a form validation method in Azure VM Agents Plugin allowed users with Overall/Read access to verify a submitted configuration, obtaining limited information about the Azure account and configuration.
Additionally, this form validation method did not require POST requests, resulting in a potential CSRF vulnerability.
This form validation method now requires POST requests and Overall/Administer permissions.
Missing permission check in Azure VM Agents Plugin allowed modifying VM configuration
SECURITY-1331 / CVE-2019-1003036
A missing permission check in an HTTP endpoint allowed users with Overall/Read access to attach a public IP address to an Azure VM in Azure VM Agents Plugin, making a virtual machine publicly accessible.
Additionally, this form validation method did not require POST requests, resulting in a CSRF vulnerability with more limited impact, as the IP address would not be known.
This form validation method now requires POST requests and Overall/Administer permissions.
Unprivileged users with Overall/Read access are able to enumerate credential IDs in Azure VM Agents Plugin
SECURITY-1332 / CVE-2019-1003037
Azure VM Agents Plugin provides a list of applicable credential IDs to allow administrators configuring the plugin to select the one to use.
This functionality did not check permissions, allowing any user with Overall/Read permission to get a list of valid credentials IDs. Those could be used as part of an attack to capture the credentials using another vulnerability.
An enumeration of credentials IDs in this plugin now requires Overall/Administer permission.
Repository Connector Plugin stored password in plain text
SECURITY-958 / CVE-2019-1003038
Repository Connector Plugin stored the username and password in its configuration unencrypted in its global configuration file on the Jenkins master. This password could be viewed by users with access to the master file system.
The plugin now stores the password encrypted in the configuration files on disk and no longer transfers it to users viewing the configuration form in plain text.
AppDynamics Dashboard Plugin stored password in plain text
SECURITY-1087 / CVE-2019-1003039
AppDynamics Dashboard Plugin stored username and password in its configuration unencrypted in jobs' config.xml files on the Jenkins master. This password could be viewed by users with Extended Read permission, or access to the master file system.
While masked from view using a password form field, the password was transferred in plain text to users when accessing the job configuration form.
AppDynamics Dashboard Plugin now stores the password encrypted in the configuration files on disk and no longer transfers it to users viewing the configuration form in plain text. Existing jobs need to have their configuration saved for existing plain text passwords to be overwritten.
Rabbit-MQ Publisher Plugin stored password in plain text
SECURITY-848
Rabbit-MQ Publisher Plugin stored the username and password in its configuration unencrypted in its global configuration file on the Jenkins master. This password could be viewed by users with access to the master file system.
The plugin now stores the password encrypted in the configuration files on disk and no longer transfers it to users viewing the configuration form in plain text.
Missing permission check allowed connecting to RabbitMQ in Rabbit-MQ Publisher Plugin
SECURITY-970
A missing permission check in a form validation method of Rabbit-MQ Publisher Plugin allowed users with Overall/Read access to have Jenkins initiate a RabbitMQ connection to an attacker-specified host and port with an attacker-specified username and password.
Additionally, this form validation method did not require POST requests, resulting in a CSRF vulnerability.
This form validation method now requires POST requests and Overall/Administer permissions.
OSF Builder Suite For Salesforce Commerce Cloud :: Deploy Plugin stored password in plain text
SECURITY-1038
OSF Builder Suite For Salesforce Commerce Cloud : : Deploy Plugin stored the HTTP proxy username and password in its configuration unencrypted in its global configuration file on the Jenkins master. This password could be viewed by users with access to the master file system.
The plugin now integrates with Credentials Plugin to store the HTTP proxy credentials.
SSRF and data modification vulnerability due to missing permission check in Bitbar Run-in-Cloud
SECURITY-1088
A missing permission check in a method performing both form validation and saving new configuration in Bitbar Run-in-Cloud Plugin allowed users with Overall/Read permission to have Jenkins master connect to an attacker-specified host with attacker-specified credentials, and, if successful, save that as the new configuration for the plugin. This could then potentially result in future builds submitting their data to an unauthorized remote server.
Additionally, this method did not require POST requests, resulting in a CSRF vulnerability.
This form validation method now requires POST requests and Overall/Administer permissions.