A note from our new CEO Moritz Plassnig

Read the announcement
Security Advisories

CloudBees Security Advisory2023-04-12

This advisory announces vulnerabilities in 

,

and

CloudBees CI

,

and

Jenkins

,

and

CloudBees Jenkins Platform

Improper masking of credentials in multiple plugins

SECURITY-3075, BEE-31732 / CVE-2023-30513 (Kubernetes), CVE-2023-30514 (Azure Key Vault), CVE-2023-30515 (Thycotic DevOps Secrets Vault)

Severity (CVSS): [pill:Medium|https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N]

Affected plugins: [pill:kubernetes|https://plugins.jenkins.io/kubernetes], [pill:azure-keyvault|https://plugins.jenkins.io/azure-keyvault], [pill:thycotic-devops-secrets-vault|https://plugins.jenkins.io/thycotic-devops-secrets-vault], cloudbees-console-log-masker

Description:

Multiple plugins do not properly mask (i.e., replace with asterisks) credentials printed in the build log from Pipeline steps like sh and bat, when both of the following conditions are met:

The following plugins are affected by this vulnerability:

  • Kubernetes 3909.v1f2c633e8590 and earlier (SECURITY-3079 / CVE-2023-30513)
  • Azure Key Vault 187.va_cd5fecd198a_ and earlier (SECURITY-3051 / CVE-2023-30514)
  • Thycotic DevOps Secrets Vault 1.0.0 (SECURITY-3078 / CVE-2023-30515)
  • CloudBees Enhanced Credentials Masking 1.0.8 and earlier (BEE-31732)

The following plugins have been updated to properly mask credentials in the build log when push mode for durable task logging is enabled:

  • Kubernetes 3910.ve59cec5e33ea_ (SECURITY-3079 / CVE-2023-30513)
  • Azure Key Vault 188.vf46b_7fa_846a_1 (SECURITY-3051 / CVE-2023-30514)
  • CloudBees Enhanced Credentials Masking 1.0.9 (BEE-31732)

As of publication of this advisory, there is no fix available for the following plugin:

  • Thycotic DevOps Secrets Vault 1.0.0 (SECURITY-3078 / CVE-2023-30515)

An improvement in Credentials Binding 523.525.vb_72269281873 implements a workaround that applies build log masking even in affected plugins. This workaround is temporary and potentially incomplete, so it is still recommended that affected plugins be updated to resolve this issue.

Disabled SSL/TLS certificate validation for existing configurations in Image Tag Parameter Plugin

SECURITY-2840 / CVE-2023-30516

Severity (CVSS): [pill:Medium|https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N]

Affected plugin: [pill:image-tag-parameter|https://plugins.jenkins.io/image-tag-parameter]

Description:

Image Tag Parameter Plugin 2.0 improperly introduces an option to opt out of SSL/TLS certificate validation when connecting to Docker registries.

Job configurations using Image Tag Parameters that were created before 2.0 will have SSL/TLS certificate validation disabled by default.

As of publication of this advisory, there is no fix.

SSL/TLS certificate validation unconditionally disabled by NeuVector Vulnerability Scanner Plugin

SECURITY-2841 / CVE-2023-30517

Severity (CVSS): [pill:Medium|https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N]

Affected plugin: [pill:neuvector-vulnerability-scanner|https://plugins.jenkins.io/neuvector-vulnerability-scanner]

Description:

NeuVector Vulnerability Scanner Plugin 1.22 and earlier unconditionally disables SSL/TLS certificate and hostname validation when connecting to a configured NeuVector Vulnerability Scanner server.

As of publication of this advisory, there is no fix.

Missing permission check in Thycotic Secret Server Plugin allows enumerating credentials IDs

SECURITY-2837 / CVE-2023-30518

Severity (CVSS): [pill:Medium|https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N]

Affected plugin: [pill:thycotic-secret-server|https://plugins.jenkins.io/thycotic-secret-server]

Description:

Thycotic Secret Server Plugin 1.0.2 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

As of publication of this advisory, there is no fix.

Lack of authentication mechanism in Quay.io trigger Plugin webhook

SECURITY-2849 / CVE-2023-30519

Severity (CVSS): [pill:Medium|https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N]

Affected plugin: [pill:quayio-trigger|https://plugins.jenkins.io/quayio-trigger]

Description:

Quay.io trigger Plugin provides a webhook endpoint at /quayio-webhook/ that can be used to trigger builds of jobs configured to use a specified repository.

In Quay.io trigger Plugin 0.1 and earlier, this endpoint can be accessed without authentication.

This allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository.

As of publication of this advisory, there is no fix.

Stored XSS vulnerability in Quay.io trigger Plugin

SECURITY-2850 / CVE-2023-30520

Severity (CVSS): [pill:High|https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H]

Affected plugin: [pill:quayio-trigger|https://plugins.jenkins.io/quayio-trigger]

Description:

Quay.io trigger Plugin 0.1 and earlier does not limit URL schemes for repository homepage URLs submitted via Quay.io trigger webhooks.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to submit crafted Quay.io trigger webhook payloads.

As of publication of this advisory, there is no fix.

Lack of authentication mechanism in Assembla merge request builder Plugin webhook

SECURITY-2872 / CVE-2023-30521

Severity (CVSS): [pill:Medium|https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N]

Affected plugin: [pill:assembla-merge-request-builder|https://plugins.jenkins.io/assembla-merge-request-builder]

Description:

Assembla merge request builder Plugin provides a webhook endpoint at /assembla-webhook/ that can be used to trigger builds of jobs configured to use a specified repository.

In Assembla merge request builder Plugin 1.1.13 and earlier, this endpoint can be accessed without authentication.

This allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository.

As of publication of this advisory, there is no fix.

Lack of authentication mechanism in Fogbugz Plugin webhook

SECURITY-2873 / CVE-2023-30522

Severity (CVSS): [pill:Medium|https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N]

Affected plugin: [pill:fogbugz|https://plugins.jenkins.io/fogbugz]

Description:

Fogbugz Plugin provides a webhook endpoint at /fbTrigger/ that can be used to trigger builds of any jobs.

In Fogbugz Plugin 2.2.17 and earlier, this endpoint can be accessed by attackers with Item/Read permission, allowing them to trigger builds of jobs specified in a jobname request parameter.

As of publication of this advisory, there is no fix.

Tokens stored and displayed in plain text by Report Portal Plugin

SECURITY-2945 / CVE-2023-30523 (storage), CVE-2023-30524 (masking)

Severity (CVSS): [pill:Medium|https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N]

Affected plugin: [pill:reportportal|https://plugins.jenkins.io/reportportal]

Description:

Report Portal Plugin 0.5 and earlier stores ReportPortal access tokens unencrypted in job config.xml files on the Jenkins controller as part of its configuration.

These tokens can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

Additionally, the configuration form does not mask these tokens, increasing the potential for attackers to observe and capture them.

As of publication of this advisory, there is no fix.

CSRF vulnerability and missing permission check in Report Portal Plugin

SECURITY-2950 / CVE-2023-30525 (CSRF), CVE-2023-30526 (missing permission check)

Severity (CVSS): [pill:Medium|https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N]

Affected plugin: [pill:reportportal|https://plugins.jenkins.io/reportportal]

Description:

Report Portal Plugin 0.5 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified bearer token authentication.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

As of publication of this advisory, there is no fix.

Client secret stored and displayed in plain text by WSO2 Oauth Plugin

SECURITY-2992 / CVE-2023-30527 (storage), CVE-2023-30528 (masking)

Severity (CVSS): [pill:Low|https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N]

Affected plugin: [pill:wso2id-oauth|https://plugins.jenkins.io/wso2id-oauth]

Description:

WSO2 Oauth Plugin 1.0 and earlier stores the WSO2 Oauth client secret unencrypted in the global config.xml file on the Jenkins controller as part of its configuration.

This client secret can be viewed by users with access to the Jenkins controller file system.

Additionally, the global configuration form does not mask the WSO2 Oauth client secret, increasing the potential for attackers to observe and capture it.

As of publication of this advisory, there is no fix.

CSRF vulnerability in Lucene-Search Plugin

SECURITY-3013 / CVE-2023-30529

Severity (CVSS): [pill:Medium|https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N]

Affected plugin: [pill:lucene-search|https://plugins.jenkins.io/lucene-search]

Description:

Lucene-Search Plugin 387.v938a_ecb_f7fe9 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to reindex the database.

As of publication of this advisory, there is no fix.

Token stored and displayed in plain text by Consul KV Builder Plugin

SECURITY-2944 / CVE-2023-30530 (storage), CVE-2023-30531 (masking)

Severity (CVSS): [pill:Medium|https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N]

Affected plugin: [pill:consul-kv-builder|https://plugins.jenkins.io/consul-kv-builder]

Description:

Consul KV Builder Plugin 2.0.13 and earlier stores the HashiCorp Consul ACL Token unencrypted in its global configuration file org.jenkinsci.plugins.consulkv.GlobalConsulConfig.xml on the Jenkins controller as part of its configuration.

This token can be viewed by users with access to the Jenkins controller file system.

Additionally, the global configuration form does not mask the token, increasing the potential for attackers to observe and capture it.

As of publication of this advisory, there is no fix.

Lack of authentication mechanism in TurboScript Plugin webhook

SECURITY-2851 / CVE-2023-30532

Severity (CVSS): [pill:Medium|https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N]

Affected plugin: [pill:spoonscript|https://plugins.jenkins.io/spoonscript]

Description:

TurboScript Plugin provides a webhook endpoint at /turbo-webhook/ that can be used to trigger builds of jobs configured to use a specified repository.

In TurboScript Plugin 1.3 and earlier, this endpoint can be accessed by attackers with Item/Read permission to trigger builds of jobs corresponding to the attacker-specified repository.

As of publication of this advisory, there is no fix.

Severity

Fix

  • CloudBees Traditional Platforms should be upgraded to 2.387.2.4
  • CloudBees Cloud Platforms should be upgraded to 2.387.2.4
  • CloudBees Jenkins Platform (fixed train, CJP Operations Center and CJP Client Master (2.346.x.0.z)) should be upgraded to 2.346.40.0.15

Subscription confirmed

You'll now be notified automatically when new vulnerabilities
are disclosed