A note from our new CEO Moritz Plassnig

Read the announcement
Security Advisories

CloudBees Security Advisory2023-07-12

This advisory announces vulnerabilities in 

,

and

Jenkins

,

and

CloudBees CI

XXE vulnerability in External Monitor Job Type Plugin

SECURITY-3133 / CVE-2023-37942

Severity (CVSS): [pill:High|https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N]

Affected plugin: [pill:external-monitor-job|https://plugins.jenkins.io/external-monitor-job]

Description:

External Monitor Job Type Plugin 206.v9a_94ff0b_4a_10 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers with Item/Build permission to have Jenkins parse a crafted HTTP request with XML data that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

External Monitor Job Type Plugin 207.v98a_a_37a_85525 disables external entity resolution for its XML parser.

Password transmitted in plain text by Active Directory Plugin

SECURITY-3059 / CVE-2023-37943

Severity (CVSS): [pill:Low|https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N]

Affected plugin: [pill:active-directory|https://plugins.jenkins.io/active-directory]

Description:

Active Directory Plugin allows testing a new, unsaved configuration by performing a connection test (the button labeled "Test Domain").

Active Directory Plugin 2.30 and earlier ignores the "Require TLS" and "StartTls" options and always performs the connection test to Active directory unencrypted. This allows attackers able to capture network traffic between the Jenkins controller and Active Directory servers to obtain Active Directory credentials.

This only affects the connection test. Connections established during the login process are encrypted if the corresponding TLS option is enabled.

Active Directory Plugin 2.30.1 considers the "Require TLS" and "StartTls" options for connection tests.

Missing permission check in Datadog Plugin allows capturing credentials

SECURITY-3130 / CVE-2023-37944

Severity (CVSS): [pill:Medium|https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N]

Affected plugin: [pill:datadog|https://plugins.jenkins.io/datadog]

Description:

Datadog Plugin 5.4.1 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Datadog Plugin 5.4.2 requires Overall/Administer permission to access the affected HTTP endpoint.

Missing permission check in SAML Single Sign On(SSO) Plugin

SECURITY-3164 / CVE-2023-37945

Severity (CVSS): [pill:Medium|https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N]

Affected plugin: [pill:miniorange-saml-sp|https://plugins.jenkins.io/miniorange-saml-sp]

Description:

SAML Single Sign On(SSO) Plugin 2.3.0 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to download a string representation of the current security realm (Java Object#toString()), which potentially includes sensitive information.

SAML Single Sign On(SSO) Plugin 2.3.1 requires Overall/Administer permission to access the affected HTTP endpoint, and only allows downloading a string representation if the current security realm is this plugin’s.

Session fixation vulnerability in OpenShift Login Plugin

SECURITY-2998 / CVE-2023-37946

Severity (CVSS): [pill:High|https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H]

Affected plugin: [pill:openshift-login|https://plugins.jenkins.io/openshift-login]

Description:

OpenShift Login Plugin 1.1.0.227.v27e08dfb_1a_20 and earlier does not invalidate the existing session on login.

This allows attackers to use social engineering techniques to gain administrator access to Jenkins.

OpenShift Login Plugin 1.1.0.230.v5d7030b_f5432 invalidates the existing session on login.

Open redirect vulnerability in OpenShift Login Plugin

SECURITY-2999 / CVE-2023-37947

Severity (CVSS): [pill:Medium|https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N]

Affected plugin: [pill:openshift-login|https://plugins.jenkins.io/openshift-login]

Description:

OpenShift Login Plugin 1.1.0.227.v27e08dfb_1a_20 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins.

This allows attackers to perform phishing attacks by having users go to a Jenkins URL that will forward them to a different site after successful authentication.

OpenShift Login Plugin 1.1.0.230.v5d7030b_f5432 only redirects to relative (Jenkins) URLs.

Missing SSH host key validation in Oracle Cloud Infrastructure Compute Plugin

SECURITY-3044 / CVE-2023-37948

Severity (CVSS): [pill:Medium|https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N]

Affected plugin: [pill:oracle-cloud-infrastructure-compute|https://plugins.jenkins.io/oracle-cloud-infrastructure-compute]

Description:

Oracle Cloud Infrastructure Compute Plugin 1.0.16 and earlier does not perform SSH host key validation when connecting to OCI clouds.

This lack of validation could be abused using a man-in-the-middle attack to intercept these connections to OCI clouds.

Oracle Cloud Infrastructure Compute Plugin 1.0.17 provides strategies for performing host key validation for administrators to select the one that meets their security needs.

For more information see the plugin documentation.

The Jenkins security team has been unable to confirm the exploitability and resolution of this vulnerability.

Missing permission check in Orka by MacStadium Plugin allows capturing credentials

SECURITY-3128 / CVE-2023-37949

Severity (CVSS): [pill:Medium|https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N]

Affected plugin: [pill:macstadium-orka|https://plugins.jenkins.io/macstadium-orka]

Description:

Orka by MacStadium Plugin 1.33 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Orka by MacStadium Plugin 1.34 requires Overall/Administer permission to access the affected HTTP endpoint.

Missing permission check in mabl Plugin allows enumerating credentials IDs

SECURITY-3137 (1) / CVE-2023-37950

Severity (CVSS): [pill:Medium|https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N]

Affected plugin: [pill:mabl-integration|https://plugins.jenkins.io/mabl-integration]

Description:

mabl Plugin 0.0.46 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

An enumeration of credentials IDs in mabl Plugin 0.0.47 requires the appropriate permissions.

Exposure of system-scoped credentials in mabl Plugin

SECURITY-3137 (2) / CVE-2023-37951

Severity (CVSS): [pill:Medium|https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N]

Affected plugin: [pill:mabl-integration|https://plugins.jenkins.io/mabl-integration]

Description:

mabl Plugin 0.0.46 and earlier does not set the appropriate context for credentials lookup, allowing the use of System-scoped credentials otherwise reserved for the global configuration.

This allows attackers with Item/Configure permission to access and capture credentials they are not entitled to.

mabl Plugin 0.0.47 defines the appropriate context for credentials lookup.

CSRF vulnerability and missing permission checks in mabl Plugin allow capturing credentials

SECURITY-3127 / CVE-2023-37952 (CSRF), CVE-2023-37953 (missing permission check)

Severity (CVSS): [pill:High|https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N]

Affected plugin: [pill:mabl-integration|https://plugins.jenkins.io/mabl-integration]

Description:

mabl Plugin 0.0.46 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

mabl Plugin 0.0.47 requires POST requests and the appropriate permissions for the affected HTTP endpoints.

CSRF vulnerability in Rebuilder Plugin

SECURITY-3033 / CVE-2023-37954

Severity (CVSS): [pill:Medium|https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N]

Affected plugin: [pill:rebuild|https://plugins.jenkins.io/rebuild]

Description:

Rebuilder Plugin 320.v5a_0933a_e7d61 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to rebuild a previous build.

As of publication of this advisory, there is no fix. Learn why we announce this.

CSRF vulnerability and missing permission check in Test Results Aggregator Plugin

SECURITY-3122 / CVE-2023-37955 (CSRF), CVE-2023-37956 (missing permission check)

Severity (CVSS): [pill:Medium|https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N]

Affected plugin: [pill:test-results-aggregator|https://plugins.jenkins.io/test-results-aggregator]

Description:

Test Results Aggregator Plugin 1.2.13 and earlier does not perform a permission check in an HTTP endpoint implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password.

Additionally, this HTTP endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

As of publication of this advisory, there is no fix. Learn why we announce this.

CSRF vulnerability in Pipeline restFul API Plugin

SECURITY-3126 / CVE-2023-37957

Severity (CVSS): [pill:High|https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H]

Affected plugin: [pill:pipeline-restful-api|https://plugins.jenkins.io/pipeline-restful-api]

Description:

Pipeline restFul API Plugin 0.11 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to have Jenkins connect to an attacker-specified URL, capturing a newly generated JCLI token that allows impersonating the victim.

As of publication of this advisory, there is no fix. Learn why we announce this.

CSRF vulnerability and missing permission checks in Sumologic Publisher Plugin

SECURITY-3117 / CVE-2023-37958 (CSRF), CVE-2023-37959 (missing permission check)

Severity (CVSS): [pill:Medium|https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N]

Affected plugin: [pill:sumologic-publisher|https://plugins.jenkins.io/sumologic-publisher]

Description:

Sumologic Publisher Plugin 2.2.1 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

As of publication of this advisory, there is no fix. Learn why we announce this.

Arbitrary file read vulnerability in MathWorks Polyspace Plugin

SECURITY-3124 / CVE-2023-37960

Severity (CVSS): [pill:Medium|https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N]

Affected plugin: [pill:mathworks-polyspace|https://plugins.jenkins.io/mathworks-polyspace]

Description:

MathWorks Polyspace Plugin 1.0.5 and earlier does not restrict the path of the attached files in Polyspace Notification post-build step.

This allows attackers with Item/Configure permission to send emails with arbitrary files from the Jenkins controller file system.

As of publication of this advisory, there is no fix. Learn why we announce this.

CSRF vulnerability in Assembla Auth Plugin

SECURITY-2988 / CVE-2023-37961

Severity (CVSS): [pill:Medium|https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N]

Affected plugin: [pill:assembla-auth|https://plugins.jenkins.io/assembla-auth]

Description:

Assembla Auth Plugin 1.14 and earlier does not implement a state parameter in its OAuth flow, a unique and non-guessable value associated with each authentication request.

This vulnerability allows attackers to trick users into logging in to the attacker’s account.

As of publication of this advisory, there is no fix. Learn why we announce this.

CSRF vulnerability and missing permission checks in Benchmark Evaluator Plugin

SECURITY-3119 / CVE-2023-37962 (CSRF), CVE-2023-37963 (missing permission check)

Severity (CVSS): [pill:Medium|https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N]

Affected plugin: [pill:benchmark-evaluator|https://plugins.jenkins.io/benchmark-evaluator]

Description:

Benchmark Evaluator Plugin 1.0.1 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL and to check for the existence of directories, .csv, and .ycsb files on the Jenkins controller file system.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

As of publication of this advisory, there is no fix. Learn why we announce this.

CSRF vulnerability and missing permission checks in ElasticBox CI Plugin allow capturing credentials

SECURITY-3131 / CVE-2023-37964 (CSRF), CVE-2023-37965 (missing permission check)

Severity (CVSS): [pill:Medium|https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N]

Affected plugin: [pill:elasticbox|https://plugins.jenkins.io/elasticbox]

Description:

ElasticBox CI Plugin 5.0.1 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

As of publication of this advisory, there is no fix. Learn why we announce this.

Severity

Fix

  • CloudBees Traditional Platforms should be upgraded to 2.401.2.6
  • CloudBees Cloud Platforms should be upgraded to 2.401.2.6
  • Active Directory Plugin should be updated to version 2.30.1
  • Datadog Plugin should be updated to version 5.4.2
  • External Monitor Job Type Plugin should be updated to version 207.v98a_a_37a_85525
  • mabl Plugin should be updated to version 0.0.47
  • OpenShift Login Plugin should be updated to version 1.1.0.230.v5d7030b_f5432
  • Oracle Cloud Infrastructure Compute Plugin should be updated to version 1.0.17
  • Orka by MacStadium Plugin should be updated to version 1.34
  • SAML Single Sign On(SSO) Plugin should be updated to version 2.3.1

Subscription confirmed

You'll now be notified automatically when new vulnerabilities
are disclosed