CloudBees Security Advisory 2019-08-28

This advisory announces vulnerabilities in Jenkins, CloudBees Jenkins Distribution, CloudBees Jenkins Platform and CloudBees Core.

Stored XSS vulnerability in update center 

SECURITY-1453 / CVE-2019-10383

Jenkins did not properly escape the update site URL in some status messages shown in the update center, resulting in a stored cross-site scripting vulnerability that is exploitable by administrators and affects other administrators.

Jenkins now escapes the update site URL in status messages shown in the update center.

CSRF protection tokens for anonymous users did not expire in some circumstances 

SECURITY-1491 / CVE-2019-10384

Jenkins allowed the creation of CSRF tokens without a corresponding web session ID. This is the result of an incomplete fix for SECURITY-626 in the 2019-07-17 security advisory. This allowed attackers able to obtain a CSRF token without associated session ID to implement CSRF attacks with the following constraints:

  • The token had to be created for the anonymous user (and could only be used for actions the anonymous user can perform).

  • The victim’s IP address needed to remain unchanged (unless the proxy compatibility option was enabled).

  • The victim must not have a valid web session at the time of the attack.

CSRF token generation now creates a web session if none exists yet, so that the lack of a web session ID cannot be exploited.

NOTE

This fix may impact scripts that obtain a crumb from the crumb issuer API. They may need to be updated to retain the session ID for subsequent requests. For further information, see the LTS upgrade guide.

As a workaround, administrators can remove any permissions granted to the anonymous user so that no privileged actions can be taken. Alternatively, the Strict Crumb Issuer Plugin can be used instead of the built-in default crumb issuer to prevent this issue, because the vulnerability is not present in the plugin.

Sandbox Bypass in Splunk Plugin 

SECURITY-1294 / CVE-2019-10390

Splunk Plugin has a form validation HTTP endpoint used to validate a user-submitted Groovy script through compilation, which was not subject to sandbox protection. This allowed attackers with Overall/Read access to execute arbitrary code on the Jenkins master by applying AST transforming annotations such as @Grab to source code elements.

The affected HTTP endpoint now applies a safe Groovy compiler configuration preventing the use of unsafe AST transforming annotations.

IBM Application Security on Cloud Plugin showed plain text password in job configuration form fields 

SECURITY-1512 / CVE pending

IBM Application Security on Cloud Plugin stores service passwords in job configurations.

While the password is stored encrypted on disk, it was transmitted in plain text as part of the configuration form. This could result in exposure of the password through browser extensions, cross-site scripting vulnerabilities, and similar situations.

IBM Application Security on Cloud Plugin no longer transmits the password form field in plain text.

 

Severity: 
  • SECURITY-1294: High
  • SECURITY-1453: Medium
  • SECURITY-1491: High
  • SECURITY-1512: low
Fix: 
  • CloudBees Traditional Platforms should be upgraded 2.176.3.2
  • CloudBees Cloud Platforms should be upgraded 2.176.3.2
  • CloudBees Jenkins Enterprise should be upgraded the Managed Masters and Operations Center to 2.176.3.2
  • CloudBees Jenkins Platform (rolling train, CJP Operations Center and CJP Client Master (2.x.y.z) should be upgraded to version 2.176.3.2
  • CloudBees Jenkins Platform (fixed train, CJP Operations Center and CJP Client Master (2.138.x.0.z) should be upgraded to version 2.138.43.0.1
  • CloudBees Jenkins Platform (fixed train, CJP Operations Center and CJP Client Master (2.164.x.0.z) should be upgraded to version 2.164.31.0.1
  • CloudBees Jenkins Distribution should be upgraded to version 2.176.3.2