CloudBees Security Advisory 2023-07-12

SECURITY-3133 / CVE-2023-37942
Severity (CVSS): High
Affected plugin: external-monitor-job
Description:

External Monitor Job Type Plugin 206.v9a_94ff0b_4a_10 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers with Item/Build permission to have Jenkins parse a crafted HTTP request with XML data that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

External Monitor Job Type Plugin 207.v98a_a_37a_85525 disables external entity resolution for its XML parser.

SECURITY-3059 / CVE-2023-37943
Severity (CVSS): Low
Affected plugin: active-directory
Description:

Active Directory Plugin allows testing a new, unsaved configuration by performing a connection test (the button labeled "Test Domain").

Active Directory Plugin 2.30 and earlier ignores the "Require TLS" and "StartTls" options and always performs the connection test to Active directory unencrypted. This allows attackers able to capture network traffic between the Jenkins controller and Active Directory servers to obtain Active Directory credentials.

This only affects the connection test. Connections established during the login process are encrypted if the corresponding TLS option is enabled.

Active Directory Plugin 2.30.1 considers the "Require TLS" and "StartTls" options for connection tests.

SECURITY-3130 / CVE-2023-37944
Severity (CVSS): Medium
Affected plugin: datadog
Description:

Datadog Plugin 5.4.1 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Datadog Plugin 5.4.2 requires Overall/Administer permission to access the affected HTTP endpoint.

SECURITY-3164 / CVE-2023-37945
Severity (CVSS): Medium
Affected plugin: miniorange-saml-sp
Description:

SAML Single Sign On(SSO) Plugin 2.3.0 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to download a string representation of the current security realm (Java Object#toString()), which potentially includes sensitive information.

SAML Single Sign On(SSO) Plugin 2.3.1 requires Overall/Administer permission to access the affected HTTP endpoint, and only allows downloading a string representation if the current security realm is this plugin’s.

SECURITY-2998 / CVE-2023-37946
Severity (CVSS): High
Affected plugin: openshift-login
Description:

OpenShift Login Plugin 1.1.0.227.v27e08dfb_1a_20 and earlier does not invalidate the existing session on login.

This allows attackers to use social engineering techniques to gain administrator access to Jenkins.

OpenShift Login Plugin 1.1.0.230.v5d7030b_f5432 invalidates the existing session on login.

SECURITY-2999 / CVE-2023-37947
Severity (CVSS): Medium
Affected plugin: openshift-login
Description:

OpenShift Login Plugin 1.1.0.227.v27e08dfb_1a_20 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins.

This allows attackers to perform phishing attacks by having users go to a Jenkins URL that will forward them to a different site after successful authentication.

OpenShift Login Plugin 1.1.0.230.v5d7030b_f5432 only redirects to relative (Jenkins) URLs.

SECURITY-3044 / CVE-2023-37948
Severity (CVSS): Medium
Affected plugin: oracle-cloud-infrastructure-compute
Description:

Oracle Cloud Infrastructure Compute Plugin 1.0.16 and earlier does not perform SSH host key validation when connecting to OCI clouds.

This lack of validation could be abused using a man-in-the-middle attack to intercept these connections to OCI clouds.

Oracle Cloud Infrastructure Compute Plugin 1.0.17 provides strategies for performing host key validation for administrators to select the one that meets their security needs.

For more information see the plugin documentation.

The Jenkins security team has been unable to confirm the exploitability and resolution of this vulnerability.

SECURITY-3128 / CVE-2023-37949
Severity (CVSS): Medium
Affected plugin: macstadium-orka
Description:

Orka by MacStadium Plugin 1.33 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Orka by MacStadium Plugin 1.34 requires Overall/Administer permission to access the affected HTTP endpoint.

SECURITY-3137 (1) / CVE-2023-37950
Severity (CVSS): Medium
Affected plugin: mabl-integration
Description:

mabl Plugin 0.0.46 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

An enumeration of credentials IDs in mabl Plugin 0.0.47 requires the appropriate permissions.

SECURITY-3137 (2) / CVE-2023-37951
Severity (CVSS): Medium
Affected plugin: mabl-integration
Description:

mabl Plugin 0.0.46 and earlier does not set the appropriate context for credentials lookup, allowing the use of System-scoped credentials otherwise reserved for the global configuration.

This allows attackers with Item/Configure permission to access and capture credentials they are not entitled to.

mabl Plugin 0.0.47 defines the appropriate context for credentials lookup.

SECURITY-3127 / CVE-2023-37952 (CSRF), CVE-2023-37953 (missing permission check)
Severity (CVSS): High
Affected plugin: mabl-integration
Description:

mabl Plugin 0.0.46 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

mabl Plugin 0.0.47 requires POST requests and the appropriate permissions for the affected HTTP endpoints.

SECURITY-3033 / CVE-2023-37954
Severity (CVSS): Medium
Affected plugin: rebuild
Description:

Rebuilder Plugin 320.v5a_0933a_e7d61 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to rebuild a previous build.

As of publication of this advisory, there is no fix. Learn why we announce this.

SECURITY-3122 / CVE-2023-37955 (CSRF), CVE-2023-37956 (missing permission check)
Severity (CVSS): Medium
Affected plugin: test-results-aggregator
Description:

Test Results Aggregator Plugin 1.2.13 and earlier does not perform a permission check in an HTTP endpoint implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password.

Additionally, this HTTP endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

As of publication of this advisory, there is no fix. Learn why we announce this.

SECURITY-3126 / CVE-2023-37957
Severity (CVSS): High
Affected plugin: pipeline-restful-api
Description:

Pipeline restFul API Plugin 0.11 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to have Jenkins connect to an attacker-specified URL, capturing a newly generated JCLI token that allows impersonating the victim.

As of publication of this advisory, there is no fix. Learn why we announce this.

SECURITY-3117 / CVE-2023-37958 (CSRF), CVE-2023-37959 (missing permission check)
Severity (CVSS): Medium
Affected plugin: sumologic-publisher
Description:

Sumologic Publisher Plugin 2.2.1 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

As of publication of this advisory, there is no fix. Learn why we announce this.

SECURITY-3124 / CVE-2023-37960
Severity (CVSS): Medium
Affected plugin: mathworks-polyspace
Description:

MathWorks Polyspace Plugin 1.0.5 and earlier does not restrict the path of the attached files in Polyspace Notification post-build step.

This allows attackers with Item/Configure permission to send emails with arbitrary files from the Jenkins controller file system.

As of publication of this advisory, there is no fix. Learn why we announce this.

SECURITY-2988 / CVE-2023-37961
Severity (CVSS): Medium
Affected plugin: assembla-auth
Description:

Assembla Auth Plugin 1.14 and earlier does not implement a state parameter in its OAuth flow, a unique and non-guessable value associated with each authentication request.

This vulnerability allows attackers to trick users into logging in to the attacker’s account.

As of publication of this advisory, there is no fix. Learn why we announce this.

SECURITY-3119 / CVE-2023-37962 (CSRF), CVE-2023-37963 (missing permission check)
Severity (CVSS): Medium
Affected plugin: benchmark-evaluator
Description:

Benchmark Evaluator Plugin 1.0.1 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL and to check for the existence of directories, .csv, and .ycsb files on the Jenkins controller file system.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

As of publication of this advisory, there is no fix. Learn why we announce this.

SECURITY-3131 / CVE-2023-37964 (CSRF), CVE-2023-37965 (missing permission check)
Severity (CVSS): Medium
Affected plugin: elasticbox
Description:

ElasticBox CI Plugin 5.0.1 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

As of publication of this advisory, there is no fix. Learn why we announce this.

• SECURITY-2988: Medium

• SECURITY-2998: High

• SECURITY-2999: Medium

• SECURITY-3033: Medium

• SECURITY-3044: Medium

• SECURITY-3059: Low

• SECURITY-3117: Medium

• SECURITY-3119: Medium

• SECURITY-3122: Medium

• SECURITY-3124: Medium

• SECURITY-3126: High

• SECURITY-3127: High

• SECURITY-3128: Medium

• SECURITY-3130: Medium

• SECURITY-3131: Medium

• SECURITY-3133: High

• SECURITY-3137 (1): Medium

• SECURITY-3137 (2): Medium

• SECURITY-3164: Medium

• CloudBees Traditional Platforms should be upgraded to 2.401.2.6

• CloudBees Cloud Platforms should be upgraded to 2.401.2.6

• Active Directory Plugin should be updated to version 2.30.1

• Datadog Plugin should be updated to version 5.4.2

• External Monitor Job Type Plugin should be updated to version 207.v98a_a_37a_85525

• mabl Plugin should be updated to version 0.0.47

• OpenShift Login Plugin should be updated to version 1.1.0.230.v5d7030b_f5432

• Oracle Cloud Infrastructure Compute Plugin should be updated to version 1.0.17

• Orka by MacStadium Plugin should be updated to version 1.34

• SAML Single Sign On(SSO) Plugin should be updated to version 2.3.1