CloudBees Security Advisory 2019-03-06

This advisory announces multiple vulnerabilities in Jenkins, CloudBees Jenkins Platform and CloudBees Jenkins Solutions.

Sandbox bypass in Script Security Plugin 

SECURITY-1336 (1) / CVE-2019-1003029

Script Security sandbox protection could be circumvented during parsing, compilation, and script instantiation by providing a crafted Groovy script.

Script Security Plugin is now newly applying sandbox protection during these phases.

This affected both script execution (typically invoked from other plugins) as well as an HTTP endpoint providing script validation and allowed users with Overall/Read permission to bypass the sandbox protection and execute arbitrary code on the Jenkins master.

The API GroovySandbox#run(Script, Whitelist) has been deprecated and now emits a warning to the system log about potential security problems.GroovySandbox#run(GroovyShell, String, Whitelist) replaces it. GroovySandbox#checkScriptForCompilationErrors(String, GroovyClassLoader) has been added as a safer method to implement script validation.

Sandbox bypass in Pipeline: Groovy Plugin 

SECURITY-1336 (2) / CVE-2019-1003030

Pipeline: Groovy sandbox protection could be circumvented during parsing, compilation, and script instantiation by providing a crafted Groovy script.

This allowed users able to control the contents of a pipeline to bypass the sandbox protection and execute arbitrary code on the Jenkins master.

Pipeline: Groovy Plugin now uses Script Security APIs that apply sandbox protection during these phases.

Script security sandbox bypass in Matrix Project Plugin 

SECURITY-1339 / CVE-2019-1003031

Matrix Project Plugin supports a sandboxed Groovy expression to filter matrix combinations. Its sandbox protection could be circumvented during parsing, compilation, and script instantiation by providing a crafted Groovy script.

This allowed users able to configure a Matrix project to bypass the sandbox protection and execute arbitrary code on the Jenkins master.

Matrix Project Plugin now uses Script Security APIs that apply sandbox protection during these phases.

Script security sandbox bypass in Email Extension Plugin 

SECURITY-1340 / CVE-2019-100303​​​​​​2

Email Extension Plugin supports sandboxed Groovy expressions for multiple features. Its sandbox protection could be circumvented during parsing, compilation, and script instantiation by providing a crafted Groovy script.

This allowed users able to control the plugin’s job-specific configuration to bypass the sandbox protection and execute arbitrary code on the Jenkins master.

Email Extension Plugin now uses Script Security APIs that apply sandbox protection during these phases.

Script security sandbox bypass in Groovy Plugin 

SECURITY-1338 / CVE-2019-100303​​​​​3

Groovy Plugin supports sandboxed Groovy expressions for its “System Groovy” functionality. Its sandbox protection could be circumvented during parsing, compilation, and script instantiation by providing a crafted Groovy script.

This affected both System Groovy script execution as well as an HTTP endpoint providing script validation, and allowed users with Overall/Read permission to bypass the sandbox protection and execute arbitrary code on the Jenkins master.

Groovy Plugin now uses Script Security APIs that apply sandbox protection during these phases.

Script security sandbox bypass in Job DSL Plugin 

SECURITY-1342 / CVE-2019-1003034​​

Job DSL Plugin supports sandboxed Groovy expressions for Job DSL definitions. Its sandbox protection could be circumvented during parsing, compilation, and script instantiation by providing a crafted Groovy script.

This allowed users able to control the Job DSL scripts to bypass the sandbox protection and execute arbitrary code on the Jenkins master.

Job DSL Plugin now uses Script Security APIs that apply sandbox protection during these phases.

Information disclosure in Azure VM Agents Plugin 

SECURITY-1330 / CVE-2019-1003035

A missing permission check in a form validation method in Azure VM Agents Plugin allowed users with Overall/Read access to verify a submitted configuration, obtaining limited information about the Azure account and configuration.

Additionally, this form validation method did not require POST requests, resulting in a potential CSRF vulnerability.

This form validation method now requires POST requests and Overall/Administer permissions.

Missing permission check in Azure VM Agents Plugin allowed modifying VM configuration

SECURITY-1331 / CVE-2019-1003036​​​​​​​

A missing permission check in an HTTP endpoint allowed users with Overall/Read access to attach a public IP address to an Azure VM in Azure VM Agents Plugin, making a virtual machine publicly accessible.

Additionally, this form validation method did not require POST requests, resulting in a CSRF vulnerability with more limited impact, as the IP address would not be known.

This form validation method now requires POST requests and Overall/Administer permissions.

Unprivileged users with Overall/Read access are able to enumerate credential IDs in Azure VM Agents Plugin 

SECURITY-1332 / CVE-2019-1003037​​​​​​​

Azure VM Agents Plugin provides a list of applicable credential IDs to allow administrators configuring the plugin to select the one to use.

This functionality did not check permissions, allowing any user with Overall/Read permission to get a list of valid credentials IDs. Those could be used as part of an attack to capture the credentials using another vulnerability.

An enumeration of credentials IDs in this plugin now requires Overall/Administer permission.

Repository Connector Plugin stored password in plain text 

SECURITY-958 / CVE-2019-1003038​​​​​​​

Repository Connector Plugin stored the username and password in its configuration unencrypted in its global configuration file on the Jenkins master. This password could be viewed by users with access to the master file system.

The plugin now stores the password encrypted in the configuration files on disk and no longer transfers it to users viewing the configuration form in plain text.

AppDynamics Dashboard Plugin stored password in plain text 

SECURITY-1087 / CVE-2019-1003039​​​​​​​

AppDynamics Dashboard Plugin stored username and password in its configuration unencrypted in jobs’ config.xml files on the Jenkins master. This password could be viewed by users with Extended Read permission, or access to the master file system.

While masked from view using a password form field, the password was transferred in plain text to users when accessing the job configuration form.

AppDynamics Dashboard Plugin now stores the password encrypted in the configuration files on disk and no longer transfers it to users viewing the configuration form in plain text. Existing jobs need to have their configuration saved for existing plain text passwords to be overwritten.

Rabbit-MQ Publisher Plugin stored password in plain text 

SECURITY-848

Rabbit-MQ Publisher Plugin stored the username and password in its configuration unencrypted in its global configuration file on the Jenkins master. This password could be viewed by users with access to the master file system.

The plugin now stores the password encrypted in the configuration files on disk and no longer transfers it to users viewing the configuration form in plain text.

Missing permission check allowed connecting to RabbitMQ in Rabbit-MQ Publisher Plugin

SECURITY-970

A missing permission check in a form validation method of Rabbit-MQ Publisher Plugin allowed users with Overall/Read access to have Jenkins initiate a RabbitMQ connection to an attacker-specified host and port with an attacker-specified username and password.

Additionally, this form validation method did not require POST requests, resulting in a CSRF vulnerability.

This form validation method now requires POST requests and Overall/Administer permissions.

OSF Builder Suite For Salesforce Commerce Cloud :: Deploy Plugin stored password in plain text 

SECURITY-1038

OSF Builder Suite For Salesforce Commerce Cloud : : Deploy Plugin stored the HTTP proxy username and password in its configuration unencrypted in its global configuration file on the Jenkins master. This password could be viewed by users with access to the master file system.

The plugin now integrates with Credentials Plugin to store the HTTP proxy credentials.

SSRF and data modification vulnerability due to missing permission check in Bitbar Run-in-Cloud 

SECURITY-1088

A missing permission check in a method performing both form validation and saving new configuration in Bitbar Run-in-Cloud Plugin allowed users with Overall/Read permission to have Jenkins master connect to an attacker-specified host with attacker-specified credentials, and, if successful, save that as the new configuration for the plugin. This could then potentially result in future builds submitting their data to an unauthorized remote server.

Additionally, this method did not require POST requests, resulting in a CSRF vulnerability.

This form validation method now requires POST requests and Overall/Administer permissions.

Severity: 
Fix: 
  • CloudBees Traditional Platforms should be upgraded 2.150.3.2-rev4
  • CloudBees Cloud Platforms should be upgraded 2.150.3.2-rev4
  • CloudBees Jenkins Enterprise should be upgraded the Managed Masters and Operations Center to 2.150.3.2-rev4
  • CloudBees Jenkins Platform (rolling train, CJP Operations Center and CJP Client Master 2.x.y.z) should be upgraded to version 2.150.3.2-rev4
  • CloudBees Jenkins Platform (fixed train, CJP Operations Center and CJP Client Master 2.138.x.0.z) should be upgraded to version 2.138.40.0.2-rev4
  • CloudBees Jenkins Platform (fixed train, CJP Operations Center and CJP Client Master 2.107.x.0.z) should be upgraded to version 2.107.37.0.2-rev6
  • CloudBees Jenkins Distribution should be upgraded to version 2.150.3.2-rev4