CloudBees Security Advisory 2020-09-23

SECURITY-2020 / CVE-2020-2279

Script Security Plugin provides a sandbox feature that allows low privileged users to define scripts, including Pipelines, that are generally safe to execute. Calls to code defined inside a sandboxed script are intercepted, and various allowlists are checked to determine whether the call is to be allowed.

In Script Security Plugin 1.74 and earlier, any calls from outside a sandboxed script to code defined inside a sandboxed script were always allowed. As sandboxed scripts can communicate their results through script return values and similar mechanisms, this could result in code defined inside of a sandboxed script to be called without sandbox protection.

This vulnerability allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

Script Security Plugin 1.75 will prevent code defined inside a sandbox from being invoked outside a sandboxed script.

In rare cases, invocations of sandboxed scripts may begin failing if the script return value or script binding include code defined in the sandbox and is further processed by the calling code. To resolve this issue, the affected values need to be converted inside the sandboxed script to a known safe type, such as String.

For compatibility with this change, the following plugins should be upgraded to the versions specified:

• Email Extension Plugin should be updated at least to version 2.69.2 or newer for rolling line (2.249) and fixed 2.222 and at least to version 2.68.2 for fixed 2.190.

• Warnings Next Generation Plugin should be updated to version 8.4.1.1 or newer for rolling line (2.249).

• Warnings Plugin should be updated to version 5.0.2 or newer for rolling line (2.249).

• CloudBees Template Plugin should be updated to version 4.45.1 or newer for rolling line (2.249) and fixed 2.222 and at least to version 4.43.2 for fixed 2.190.

All these upgrades are included inside incremental versions involved in this advisory:

• 2.249.1.2-rev3

• 2.222.42.0.1-rev4

• 2.190.33.0.2-rev4

SECURITY-2042 / CVE-2020-2280

Warnings Plugin 5.0.1 and earlier does not require POST requests for a form validation method intended for testing custom warnings parsers, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to execute arbitrary code.

Warnings Plugin 5.0.2 requires POST requests for the affected form validation method.

This vulnerability was caused by an incomplete fix to SECURITY-1295.

SECURITY-1958 / CVE-2020-2281

Lockable Resources Plugin 2.8 and earlier does not require POST requests for several HTTP endpoints, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to reserve, unreserve, unlock, and reset resources.

Lockable Resources Plugin 2.9 requires POST requests for the affected HTTP endpoints.

SECURITY-2004 / CVE-2020-2282

Implied Labels Plugin 0.6 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to configure the plugin.

Implied Labels Plugin 0.7 requires Overall/Administer permission to configure the plugin.

SECURITY-1885 / CVE-2020-2283

Liquibase Runner Plugin 1.4.5 and earlier does not escape changeset contents when showing them on the build page.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide Liquibase changesets evaluated by the plugin.

Liquibase Runner Plugin 1.4.7 no longer supports evaluating changesets.

SECURITY-1887 / CVE-2020-2284

Liquibase Runner Plugin 1.4.5 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers able to provide Liquibase changesets evaluated by the plugin to have Jenkins parse a crafted XML file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

Liquibase Runner Plugin 1.4.7 no longer parses Liquibase changesets.

SECURITY-2030 / CVE-2020-2285

Liquibase Runner Plugin 1.4.7 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

An enumeration of credentials IDs in Liquibase Runner Plugin 1.4.8 requires the appropriate permissions.

• SECURITY-1885: High

• SECURITY-1887: High

• SECURITY-1958: Medium

• SECURITY-2004: Medium

• SECURITY-2020: High

• SECURITY-2030: Medium

• SECURITY-2042: High

• CloudBees Traditional Platforms should be upgraded 2.249.1.2-rev3

• CloudBees Cloud Platforms should be upgraded 2.249.1.2-rev3

• CloudBees Jenkins Enterprise should be upgraded the Managed Masters and Operations Center to 2.249.1.2-rev3

• CloudBees Jenkins Platform (rolling train, CJP Operations Center and CJP Client Master (2.x.y.z) should be upgraded to version 2.249.1.2-rev3

• CloudBees Jenkins Platform (fixed train, CJP Operations Center and CJP Client Master (2.222.x.0.z) should be upgraded to version 2.222.42.0.1-rev4

• CloudBees Jenkins Platform (fixed train, CJP Operations Center and CJP Client Master (2.190.x.0.z) should be upgraded to version 2.190.33.0.2-rev4