CloudBees Security Advisory 2022-07-27

SECURITY-1468 / BEE-21945 / CVE-2022-36881

Git client Plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH.

This lack of verification could be abused using a man-in-the-middle attack to intercept these connections and because the Git Validated Merge plugin uses the Git client to perform the SSH connection it is also vulnerable

Git client Plugin 3.11.1 provides strategies for performing host key verification for administrators to select the one that meets their security needs. For more information see the plugin documentation.

SECURITY-284 / CVE-2022-36882 (CSRF), CVE-2022-36883 (permission check), CVE-2022-36884 (information disclosure)

Git Plugin provides a webhook endpoint at /git/notifyCommit that can be used to notify Jenkins of changes to an SCM repository. For its most basic functionality, this endpoint receives a repository URL, and Jenkins will schedule polling for all jobs configured with the specified repository. In Git Plugin 4.11.3 and earlier, this endpoint can be accessed with GET requests and without authentication.

In addition to this basic functionality, the endpoint also accept a sha1 parameter specifying a commit ID. If this parameter is specified, jobs configured with the specified repo will be triggered immediately, and the build will check out the specified commit.

Additionally, the output of the webhook endpoint will provide information about which jobs were triggered or scheduled for polling, including jobs the user has no permission to access.

This allows attackers with knowledge of Git repository URLs to trigger builds of jobs using a specified Git repository and to cause them to check out an attacker-specified commit, and to obtain information about the existence of jobs configured with this Git repository.

Additionally, this webhook endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

Git Plugin 4.11.4 requires a token parameter which will act as an authentication for the webhook endpoint. While GET requests remain allowed, attackers would need to be able to provide a webhook token. For more information see the plugin documentation.

SECURITY-1849 / CVE-2022-36885

GitHub Plugin 1.34.4 and earlier does not use a constant-time comparison when checking whether the provided and computed webhook signatures are equal.

This could potentially allow attackers to use statistical methods to obtain a valid webhook signature.

GitHub Plugin 1.34.5 uses a constant-time comparison when validating the webhook signature.

SECURITY-2762 / CVE-2022-36886

External Monitor Job Type Plugin 191.v363d0d1efdf8 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to create runs of an external job.

External Monitor Job Type Plugin 192.ve979ca_8b_3ccd requires POST requests for the affected HTTP endpoint.

SECURITY-2764 / CVE-2022-36889

Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the application path of the applications when configuring a deployment.

This allows attackers with Item/Configure permission to upload arbitrary files from the Jenkins controller file system to the selected service.

Deployer Framework Plugin 86.v7b_a_4a_55b_f3ec ensures that only build artifacts can be uploaded.

SECURITY-2206 / CVE-2022-36890

Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the name of files in methods implementing form validation.

This allows attackers with Item/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.

Deployer Framework Plugin 86.v7b_a_4a_55b_f3ec ensures that only files contained inside the expected directory can be accessed.

SECURITY-2205 / CVE-2022-36891

Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Item/Read permission to read deployment logs.

Deployer Framework Plugin 86.v7b_a_4a_55b_f3ec requires Deploy Now/Deploy permission to read deployment logs.

SECURITY-2766 / CVE-2022-36887

Job Configuration History Plugin 1155.v28a_46a_cc06a_5 and earlier does not require POST requests for several HTTP endpoints, resulting in cross-site request forgery (CSRF) vulnerabilities.

These vulnerabilities allow attackers to delete entries from job, agent, and system configuration history, or restore older versions of job, agent, and system configurations.

Job Configuration History Plugin 1156.v536a_97b_8d649 requires POST requests for the affected HTTP endpoints.

SECURITY-2593 / CVE-2022-36888

HashiCorp Vault Plugin 354.vdb_858fd6b_f48 and earlier does not perform permission checks in several HTTP endpoints performing Vault connection tests.

This allows attackers with Overall/Read permission to obtain credentials stored in Vault with attacker-specified path and keys.

HashiCorp Vault Plugin 355.v3b_38d767a_b_a_8 requires Overall/Administer permission to perform Vault connection tests.

SECURITY-2402 / CVE-2022-36892

rhnpush-plugin Plugin 0.5.1 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Item/Read permission but without Item/Workspace or Item/Configure permission to check whether attacker-specified file patterns match workspace contents. A sequence of requests can be used to effectively list workspace contents.

rhnpush-plugin Plugin 0.5.2 requires Item/Workspace permission to validate patterns with workspace contents.

SECURITY-2403 / CVE-2022-36893

rpmsign-plugin Plugin 0.5.0 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Item/Read permission but without Item/Workspace or Item/Configure permission to check whether attacker-specified file patterns match workspace contents. A sequence of requests can be used to effectively list workspace contents.

rpmsign-plugin Plugin 0.5.1 requires Item/Workspace permission to validate patterns with workspace contents.

SECURITY-2413 / CVE-2022-36894

CLIF Performance Testing Plugin 64.vc0d66de1dfb_f and earlier allows users to extract files from an archive without validating file paths of files contained within the archive.

This allows attackers with Overall/Read permission to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content.

As of publication of this advisory, there is no fix. Learn why we announce this.

SECURITY-2619 / CVE-2022-36895

Compuware Topaz Utilities Plugin 1.0.8 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to enumerate hosts and ports of Compuware configurations and credentials IDs of credentials stored in Jenkins. Those credentials IDs can be used as part of an attack to capture the credentials using another vulnerability.

Compuware Topaz Utilities Plugin 1.0.9 requires the appropriate permissions to enumerate hosts and ports of Compuware configurations and credentials IDs.

SECURITY-2621 / CVE-2022-36896

Compuware Source Code Download for Endevor, PDS, and ISPW Plugin 2.0.12 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to enumerate hosts and ports of Compuware configurations and credentials IDs of credentials stored in Jenkins. Those credentials IDs can be used as part of an attack to capture the credentials using another vulnerability.

Compuware Source Code Download for Endevor, PDS, and ISPW Plugin 2.0.13 requires the appropriate permissions to enumerate hosts and ports of Compuware configurations and credentials IDs.

SECURITY-2626 / CVE-2022-36897

Compuware Xpediter Code Coverage Plugin 1.0.7 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to enumerate hosts and ports of Compuware configurations and credentials IDs of credentials stored in Jenkins. Those credentials IDs can be used as part of an attack to capture the credentials using another vulnerability.

Compuware Xpediter Code Coverage Plugin 1.0.8 requires the appropriate permissions to enumerate hosts and ports of Compuware configurations and credentials IDs.

SECURITY-2628 / CVE-2022-36898

Compuware ISPW Operations Plugin 1.0.8 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to enumerate hosts and ports of Compuware configurations and credentials IDs of credentials stored in Jenkins. Those credentials IDs can be used as part of an attack to capture the credentials using another vulnerability.

Compuware ISPW Operations Plugin 1.0.9 requires the appropriate permissions to enumerate hosts and ports of Compuware configurations and credentials IDs.

SECURITY-2629 / CVE-2022-36899

Compuware ISPW Operations Plugin defines a controller/agent message that retrieves Java system properties.

Compuware ISPW Operations Plugin 1.0.8 and earlier does not restrict execution of the controller/agent message to agents. This allows attackers able to control agent processes to retrieve Java system properties. This vulnerability is only exploitable in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. See the LTS upgrade guide.

Compuware ISPW Operations Plugin 1.0.9 does not allow the affected controller/agent message to be submitted by agents for execution on the controller.

SECURITY-2630 / CVE-2022-36900

Compuware zAdviser API Plugin defines a controller/agent message that retrieves Java system properties.

Compuware zAdviser API Plugin 1.0.3 and earlier does not restrict execution of the controller/agent message to agents. This allows attackers able to control agent processes to retrieve Java system properties. This vulnerability is only exploitable in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. See the LTS upgrade guide.

Compuware zAdviser API Plugin 1.0.4 does not allow the affected controller/agent message to be submitted by agents for execution on the controller.

SECURITY-2053 / CVE-2022-36901

HTTP Request Plugin 1.15 and earlier stores HTTP Request passwords unencrypted in its global configuration file jenkins.plugins.http_request.HttpRequest.xml on the Jenkins controller as part of its configuration when using (deprecated) Basic/Digest Authentication.

These passwords can be viewed by users with access to the Jenkins controller file system.

As of publication of this advisory, there is no fix. Learn why we announce this.

SECURITY-2682 / CVE-2022-36902

Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier does not escape several fields of Moded Extended Choice parameters.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

As of publication of this advisory, there is no fix. Learn why we announce this.

SECURITY-2665 (1) / CVE-2022-36903

Repository Connector Plugin 2.2.0 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

As of publication of this advisory, there is no fix. Learn why we announce this.

SECURITY-2665 (2) / CVE-2022-36904

Repository Connector Plugin 2.2.0 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system. A sequence of requests can be used to effectively list the Jenkins controller file system.

As of publication of this advisory, there is no fix. Learn why we announce this.

SECURITY-2686 / CVE-2022-36905

Maven Metadata Plugin for Jenkins CI server Plugin 2.2 and earlier does not perform URL validation for the Repository Base URL of List maven artifact versions parameters.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

As of publication of this advisory, there is no fix. Learn why we announce this.

SECURITY-1375 (1) / CVE-2022-36906 (CSRF), CVE-2022-36907 (missing permission check)

OpenShift Deployer Plugin 1.2.0 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

As of publication of this advisory, there is no fix. Learn why we announce this.

SECURITY-1375 (2) / CVE-2022-36908 (CSRF), CVE-2022-36909 (missing permission check)

OpenShift Deployer Plugin 1.2.0 and earlier does not perform permission checks in methods implementing form validation.

This allows attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system and to upload a SSH key file from the Jenkins controller file system to an attacker-specified URL.

Additionally, these form validation methods do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

As of publication of this advisory, there is no fix. Learn why we announce this.

SECURITY-2048 / CVE-2022-36910

Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to reindex the database and to obtain information about jobs otherwise inaccessible to them.

As of publication of this advisory, there is no fix. Learn why we announce this.

SECURITY-2105 (1) / CVE-2022-36911 (CSRF), CVE-2022-36912 (missing permission check)

Openstack Heat Plugin 1.5 and earlier does not perform permission checks in methods implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL.

Additionally, these form validation methods do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

As of publication of this advisory, there is no fix. Learn why we announce this.

SECURITY-2105 (2) / CVE-2022-36913

Openstack Heat Plugin 1.5 and earlier does not perform permission checks in methods implementing form validation.

This allows attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system. A sequence of requests can be used to effectively list the Jenkins controller file system.

As of publication of this advisory, there is no fix. Learn why we announce this.

SECURITY-2210 / CVE-2022-36914

Files Found Trigger Plugin 1.5 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system. A sequence of requests can be used to effectively list the Jenkins controller file system.

As of publication of this advisory, there is no fix. Learn why we announce this.

SECURITY-2404 / CVE-2022-36915

Android Signing Plugin 2.2.5 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Item/Read permission but without Item/Workspace or Item/Configure permission to check whether attacker-specified file patterns match workspace contents. A sequence of requests can be used to effectively list workspace contents.

As of publication of this advisory, there is no fix. Learn why we announce this.

SECURITY-2656 / CVE-2022-36916 (CSRF), CVE-2022-36917 (missing permission check)

Google Cloud Backup Plugin 0.6 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to request a manual backup.

Additionally, this HTTP endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

As of publication of this advisory, there is no fix. Learn why we announce this.

SECURITY-2747 / CVE-2022-36918

Buckminster Plugin 1.1.1 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system. A sequence of requests can be used to effectively list the Jenkins controller file system.

As of publication of this advisory, there is no fix. Learn why we announce this.

SECURITY-2790 (1) / CVE-2022-36919

Coverity Plugin 1.11.4 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

As of publication of this advisory, there is no fix. Learn why we announce this.

SECURITY-2790 (2) / CVE-2022-36920 (CSRF), CVE-2022-36921 (permission check)

Coverity Plugin 1.11.4 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, this HTTP endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

As of publication of this advisory, there is no fix. Learn why we announce this.

SECURITY-2812 / CVE-2022-36922

Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not escape the search query parameter displayed on the search result page.

This results in a reflected cross-site scripting (XSS) vulnerability.

As of publication of this advisory, there is no fix. Learn why we announce this.

• BEE-21945: Medium

• SECURITY-284: Medium

• SECURITY-1375 (1): Medium

• SECURITY-1375 (2): Medium

• SECURITY-1468: Medium

• SECURITY-1849: Low

• SECURITY-2048: Medium

• SECURITY-2053: Low

• SECURITY-2105 (1): Medium

• SECURITY-2105 (2): Medium

• SECURITY-2205: Medium

• SECURITY-2206: Medium

• SECURITY-2210: Medium

• SECURITY-2402: Medium

• SECURITY-2403: Medium

• SECURITY-2404: Medium

• SECURITY-2413: High

• SECURITY-2593: Medium

• SECURITY-2619: Medium

• SECURITY-2621: Medium

• SECURITY-2626: Medium

• SECURITY-2628: Medium

• SECURITY-2629: Medium

• SECURITY-2630: Medium

• SECURITY-2656: Medium

• SECURITY-2665 (1): Medium

• SECURITY-2665 (2): Medium

• SECURITY-2682: High

• SECURITY-2686: High

• SECURITY-2747: Medium

• SECURITY-2762: Medium

• SECURITY-2764: Medium

• SECURITY-2766: Medium

• SECURITY-2790 (1): Medium

• SECURITY-2790 (2): High

• SECURITY-2812: High

• CloudBees Traditional Platforms should be upgraded to 2.346.2.3

• CloudBees Cloud Platforms should be upgraded to 2.346.2.3

• CloudBees Jenkins Enterprise should be upgraded to 2.346.2.3 the Managed Masters and Operations Center

• CloudBees Jenkins Platform (rolling train, CJP Operations Center and CJP Client Master (2.x.y.z)) should be upgraded to 2.346.2.3 version

• CloudBees Jenkins Platform (fixed train, CJP Operations Center and CJP Client Master (2.303.x.0.z)) should be upgraded to 2.303.30.0.15 version