Controller-to-operations center security bypass vulnerability in CloudBees Operations Center Context Plugin
BEE-56866
Severity (CVSS): High
Description:
The agent-to-controller security subsystem in Jenkins is also used in CloudBees CI to protect the operations center from unauthorized commands sent by connected controllers.
In CloudBees Operations Center Context Plugin 3.27588 and earlier, this security subsystem was not enforced on a separate communication channel used for Move/Copy/Promote operations between the operations center and connected controllers.
This allows an attacker with Overall/Administer permissions on a controller connected to the operations center to send crafted instructions intended for other recipients (such as agents). This can result in arbitrary code execution within the operations center JVM.
CloudBees Operations Center Context Plugin 3.27637 applies the agent-to-controller security subsystem to the communication channel for Move/Copy/Promote operations, preventing the execution of instructions intended for different recipients.
Path traversal vulnerability in CloudBees Operations Center Context Plugin
BEE-56332
Severity (CVSS): Medium
Description:
CloudBees Operations Center Context Plugin before 3.27637 does not sanitize paths in temporary archives received from other controllers for the "Copy archived artifacts from a remote/local job" build step and copyRemoteArtifacts Pipeline step.
This allows attackers with Overall/Administer permission on the connected controller used as the source for that build step to generate crafted archives that write to arbitrary attacker-chosen locations on the destination node's file system when extracted by the build step. If the job copying the artifacts has its workspace on the built-in node of the destination controller, this can result in arbitrary code execution, as this issue allows deploying files into sensitive directories, e.g., into the plugins/ or init.groovy.d/ directories in the Jenkins home directory, where they will be executed after controller restart.
CloudBees Operations Center Context Plugin 3.27637 sanitizes paths in temporary archives received from other controllers for the affected steps.