Jenkins Security Advisory 2021-11-12

Stored XSS vulnerability in Active Choices Plugin 

SECURITY-2219 / CVE-2021-21699

Active Choices Plugin 2.5.6 and earlier does not escape the parameter name of reactive parameters and dynamic reference parameters.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.

Active Choices Plugin 2.5.7 escapes references to parameter names.

Stored XSS vulnerability in Scriptler Plugin 

SECURITY-2406 / CVE-2021-21700

Scriptler Plugin 3.3 and earlier does not escape the name of scripts on the UI when asking to confirm their deletion.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create Scriptler scripts.

Scriptler Plugin 3.4 escapes the name of scripts on the UI when asking to confirm their deletion.

XXE vulnerability in Performance Plugin 

SECURITY-2394 / CVE-2021-21701

Performance Plugin 3.20 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers able to control workspace contents to have Jenkins parse a crafted XML report file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

As of publication of this advisory, there is no fix.

XXE vulnerability in pom2config Plugin 

SECURITY-2415 / CVE-2021-43576

pom2config Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers with Overall/Read and Item/Read permissions to have Jenkins parse a crafted XML file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

As of publication of this advisory, there is no fix.

XXE vulnerability in OWASP Dependency-Check Plugin 

SECURITY-2488 / CVE-2021-43577

OWASP Dependency-Check Plugin 5.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers able to control workspace contents to have Jenkins parse a crafted XML file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

As of publication of this advisory, there is no fix.

Arbitrary file write vulnerability in Squash TM Publisher (Squash4Jenkins) Plugin 

SECURITY-2525 / CVE-2021-43578

Squash TM Publisher (Squash4Jenkins) Plugin 1.0.0 and earlier implements an agent-to-controller message that does not implement any validation of its input.

This allows attackers able to control agent processes to replace arbitrary files on the Jenkins controller file system with an attacker-controlled JSON string.

As of publication of this advisory, there is no fix.

Credit 

The Jenkins project would like to thank the reporters for discovering and reporting these vulnerabilities:

• Adith Sudhakar working with Trend Micro Zero Day Initiative for SECURITY-2394, SECURITY-2415

• Daniel Beck, CloudBees, Inc. for SECURITY-2525

• Guy Lederfein of Trend Micro for SECURITY-2406

• Kevin Guerroudj, and, independently, Audrey Prieur of Trend Micro for SECURITY-2219

• SECURITY-2219: High

• SECURITY-2394: High

• SECURITY-2406: High

• SECURITY-2415: High

• SECURITY-2488: High

• SECURITY-2525: High

   

• Active Choices Plugin should be updated to version 2.5.7

• Scriptler Plugin should be updated to version 3.4

These versions include fixes to the vulnerabilities described above. All prior versions are considered to be affected by these vulnerabilities unless otherwise indicated.

As of publication of this advisory, no fixes are available for the following plugins:

• OWASP Dependency-Check Plugin

• Performance Plugin

• pom2config Plugin

• Squash TM Publisher (Squash4Jenkins) Plugin