CloudBees Security Advisory 2023-12-13

SECURITY-3327 / CVE-2023-5072
Severity (CVSS): Medium
Affected plugin: analysis-model-api
Description:

Analysis Model API Plugin 11.11.0 and earlier bundles versions of JSON-Java vulnerable to CVE-2023-5072.

This may allow attackers able to control input to cause a Denial of Service (DoS) by parsing a crafted JSON document.

Note: As of publication, Synopsys Rapid Scan Static is the only plugin the Jenkins security team is aware of whose report parser is potentially affected.

Analysis Model API Plugin 11.13.0 updates JSON-Java to version 20231013, which is unaffected by this issue.

SECURITY-3205 / CVE-2023-50764
Severity (CVSS): High
Affected plugin: scriptler
Description:

Scriptler Plugin 342.v6a_89fd40f466 and earlier does not restrict a file name query parameter in an HTTP endpoint.

This allows attackers with Scriptler/Configure permission to delete arbitrary files on the Jenkins controller file system.

Scriptler Plugin 344.v5a_ddb_5f9e685 ensures that the file being deleted is located in the expected directory.

SECURITY-3206 / CVE-2023-50765
Severity (CVSS): Medium
Affected plugin: scriptler
Description:

Scriptler Plugin 342.v6a_89fd40f466 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to read the contents of a Groovy script by knowing its ID.

Scriptler Plugin 344.v5a_ddb_5f9e685 requires the appropriate permission to read the contents of a Groovy script.

SECURITY-3204 / CVE-2023-50766 (CSRF), CVE-2023-50767 (missing permission check)
Severity (CVSS): High
Affected plugin: nexus-jenkins-plugin
Description:

Nexus Platform Plugin 3.18.0-03 and earlier does not perform permission checks in methods implementing form validation.

This allows attackers with Overall/Read permission to send an HTTP request to an attacker-specified URL and parse the response as XML.

Additionally, the plugin does not configure its XML parser to prevent XML external entity (XXE) attacks, so attackers can have Jenkins parse a crafted XML response that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

Additionally, these form validation methods do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

Nexus Platform Plugin 3.18.1-01 configures its XML parser to prevent XML external entity (XXE) attacks.

Additionally, POST requests and Overall/Administer permission are required for the affected HTTP endpoints.

Note: Nexus Platform Plugin is not currently distributed by the Jenkins Project due to licensing issues. The fixed version can be downloaded from the Sonatype website

SECURITY-3203 / CVE-2023-50768 (CSRF), CVE-2023-50769 (missing permission check)
Severity (CVSS): Medium
Affected plugin: nexus-jenkins-plugin
Description:

Nexus Platform Plugin 3.18.0-03 and earlier does not perform permission checks in methods implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, these form validation methods do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

Nexus Platform Plugin 3.18.1-01 requires POST requests and Overall/Administer permission for the affected form validation methods.

Note: Nexus Platform Plugin is not currently distributed by the Jenkins Project due to licensing issues. The fixed version can be downloaded from the Sonatype website.

SECURITY-3168 / CVE-2023-50770
Severity (CVSS): Medium
Affected plugin: oic-auth
Description:

OpenId Connect Authentication Plugin provides an anti-lockout feature, which allows administrators to define a local user account that can be used to recover access to Jenkins.

In OpenId Connect Authentication Plugin 2.6 and earlier the password to that account is stored in a recoverable format.

This allows attackers with access to the Jenkins controller file system to recover the plain text password of that account, likely gaining administrator access to Jenkins.

As of publication of this advisory, there is no fix. Learn why we announce this.

SECURITY-2979 / CVE-2023-50771
Severity (CVSS): Medium
Affected plugin: oic-auth
Description:

OpenId Connect Authentication Plugin 2.6 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins.

This allows attackers to perform phishing attacks by having users go to a Jenkins URL that will forward them to a different site after successful authentication.

As of publication of this advisory, there is no fix. Learn why we announce this.

SECURITY-3184 / CVE-2023-50772 (storage), CVE-2023-50773 (masking)
Severity (CVSS): Medium
Affected plugin: dingding-json-pusher
Description:

Dingding JSON Pusher Plugin 2.0 and earlier stores access tokens unencrypted in job config.xml files on the Jenkins controller as part of its configuration.

These tokens can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

Additionally, the job configuration form does not mask these tokens, increasing the potential for attackers to observe and capture them.

As of publication of this advisory, there is no fix. Learn why we announce this.

SECURITY-3183 / CVE-2023-50774
Severity (CVSS): High
Affected plugin: htmlresource
Description:

HTMLResource Plugin 1.02 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to delete arbitrary files on the Jenkins controller file system.

As of publication of this advisory, there is no fix. Learn why we announce this.

SECURITY-3092 / CVE-2023-50775
Severity (CVSS): Medium
Affected plugin: ec2-deployment-dashboard
Description:

Deployment Dashboard Plugin 1.0.10 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to copy jobs.

As of publication of this advisory, there is no fix. Learn why we announce this.

SECURITY-3182 / CVE-2023-50776 (storage), CVE-2023-50777 (masking)
Severity (CVSS): Medium
Affected plugin: paaslane-estimate
Description:

PaaSLane Estimate Plugin 1.0.4 and earlier stores PaaSLane authentication tokens unencrypted in job config.xml files on the Jenkins controller as part of its configuration.

These tokens can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

Additionally, the job configuration form does not mask these tokens, increasing the potential for attackers to observe and capture them.

As of publication of this advisory, there is no fix. Learn why we announce this.

SECURITY-3179 / CVE-2023-50778 (CSRF), CVE-2023-50779 (missing permission check)
Severity (CVSS): Medium
Affected plugin: paaslane-estimate
Description:

PaaSLane Estimate Plugin 1.0.4 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified token.

Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

As of publication of this advisory, there is no fix. Learn why we announce this.

• SECURITY-2979: Medium

• SECURITY-3092: Medium

• SECURITY-3168: Medium

• SECURITY-3179: Medium

• SECURITY-3182: Medium

• SECURITY-3183: High

• SECURITY-3184: Medium

• SECURITY-3203: Medium

• SECURITY-3204: High

• SECURITY-3205: High

• SECURITY-3206: Medium

• SECURITY-3327: Medium

• CloudBees Traditional Platforms should be upgraded to 2.426.2.2

• CloudBees Cloud Platforms should be upgraded to 2.426.2.2