CVE-2020-2137: Jenkins Security Advisory 2020-03-09

This advisory announces vulnerabilities in the following Jenkins deliverables:

• Audit Trail Plugin
• Backlog Plugin
• Cobertura Plugin
• CryptoMove Plugin
• DeployHub Plugin
• Git Plugin
• Literate Plugin
• Logstash Plugin
• Mac Plugin
• OpenShift Deployer Plugin
• P4 Plugin
• Quality Gates Plugin
• Repository Connector Plugin
• Rundeck Plugin
• Script Security Plugin
• Skytap Cloud CI Plugin
• Sonar Quality Gates Plugin
• Subversion Release Manager Plugin
• Timestamper Plugin
• Zephyr Enterprise Test Management Plugin
• Zephyr for JIRA Test Management Plugin

Descriptions****Sandbox bypass vulnerability in Script Security Plugin

SECURITY-1754 / CVE-2020-2134 (constructors), CVE-2020-2135 (GroovyInterceptable)
Severity (CVSS): High
Affected plugin: script-security
Description:

Sandbox protection in Script Security Plugin 1.70 and earlier can be circumvented through:

• Crafted constructor calls and bodies (due to an incomplete fix of SECURITY-582)

• Crafted method calls on objects that implement GroovyInterceptable

This allows attackers able to specify and run sandboxed scripts to execute arbitrary code in the context of the Jenkins controller JVM.

Script Security Plugin 1.71 has additional restrictions and sanity checks to ensure that super constructors cannot be constructed without being intercepted by the sandbox. In addition, it also intercepts method calls on objects that implement GroovyInterceptable as calls to GroovyObject#invokeMethod(String, Object), which is on the list of dangerous signatures and should not be approved for use in the sandbox.

Stored XSS vulnerability in Git Plugin

SECURITY-1723 / CVE-2020-2136
Severity (CVSS): Medium
Affected plugin: git
Description:

Git Plugin 4.2.0 and earlier does not escape the error message for the repository URL for Microsoft TFS field form validation.

This results in a stored cross-site scripting vulnerability that can be exploited by users with Job/Configure permission.

Git Plugin 4.2.1 escapes the affected part of the error message.

Stored XSS vulnerability in Timestamper Plugin

SECURITY-1784 / CVE-2020-2137
Severity (CVSS): Medium
Affected plugin: timestamper
Description:

Timestamper Plugin 1.11.1 and earlier does not escape or sanitize the HTML formatting used to display the timestamps in console output for builds.

This results in a stored cross-site scripting vulnerability that can be exploited by users with Overall/Administer permission.

Timestamper Plugin 1.11.2 sanitizes the HTML formatting for timestamps and only allows basic, safe HTML formatting.

XXE vulnerability in Cobertura Plugin

SECURITY-1700 / CVE-2020-2138
Severity (CVSS): High
Affected plugin: cobertura
Description:

Cobertura Plugin 1.15 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows a user able to control the input files for the ‘Publish Cobertura Coverage Report’ post-build step to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

Cobertura Plugin 1.16 disables external entity resolution for its XML parser.

Arbitrary file write vulnerability in Cobertura Plugin

SECURITY-1668 / CVE-2020-2139
Severity (CVSS): Medium
Affected plugin: cobertura
Description:

Cobertura Plugin 1.15 and earlier does not validate file paths from the XML file it parses.

This allows attackers able to control the coverage report content to overwrite any file on the Jenkins controller file system.

Cobertura Plugin 1.16 sanitizes the file paths to prevent escape from the base directory.

XSS vulnerability in Audit Trail Plugin

SECURITY-1722 / CVE-2020-2140
Severity (CVSS): Medium
Affected plugin: audit-trail
Description:

Audit Trail Plugin 3.2 and earlier does not escape the error message for the URL Patterns field form validation.

This results in a reflected cross-site scripting vulnerability that can also be exploited similar to a stored cross-site scripting vulnerability by users with Overall/Administer permission.

Audit Trail Plugin 3.3 escapes the affected part of the error message.

CSRF vulnerability and missing permission checks in P4 Plugin

SECURITY-1765 / CVE-2020-2141 (CSRF), CVE-2020-2142 (missing permission check)
Severity (CVSS): Medium
Affected plugin: p4
Description:

P4 Plugin 1.10.10 and earlier does not perform permission checks in several HTTP endpoints. This allows users with Overall/Read access to trigger builds or add labels in the Perforce repository.

Additionally, these endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

P4 Plugin 1.10.11 requires POST requests and appropriate user permissions for the affected HTTP endpoints.

Credentials transmitted in plain text by Logstash Plugin

SECURITY-1516 / CVE-2020-2143
Severity (CVSS): Low
Affected plugin: logstash
Description:

Logstash Plugin stores credentials in its global configuration file jenkins.plugins.logstash.LogstashConfiguration.xml on the Jenkins controller as part of its configuration.

While the credentials are stored encrypted on disk, they are transmitted in plain text as part of the configuration form by Logstash Plugin 2.3.1 and earlier. This can result in exposure of the credential through browser extensions, cross-site scripting vulnerabilities, and similar situations.

Logstash Plugin 2.3.2 transmits the credentials in its global configuration encrypted.

XXE vulnerability in Rundeck Plugin

SECURITY-1702 / CVE-2020-2144
Severity (CVSS): High
Affected plugin: rundeck
Description:

Rundeck Plugin 3.6.6 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows a user with Overall/Read access to have Jenkins parse a crafted HTTP request with XML data that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

Rundeck Plugin 3.6.7 disables external entity resolution for its XML parser.

Credentials stored in plain text by Zephyr Enterprise Test Management Plugin

SECURITY-1596 / CVE-2020-2145
Severity (CVSS): Low
Affected plugin: zephyr-enterprise-test-management
Description:

Zephyr Enterprise Test Management Plugin 1.9.1 and earlier stores its Zephyr password in plain text in the global configuration file com.thed.zephyr.jenkins.reporter.ZeeReporter.xml. This password can be viewed by users with access to the Jenkins controller file system.

Zephyr Enterprise Test Management Plugin 1.10 integrates with Credentials Plugin.

Missing SSH host key validation in Mac Plugin

SECURITY-1692 / CVE-2020-2146
Severity (CVSS): Medium
Affected plugin: mac
Description:

Mac Plugin 1.1.0 and earlier does not use SSH host key validation when connecting to Mac Cloud host launched by the plugin. This lack of validation could be abused using a man-in-the-middle attack to intercept these connections to build agents.

Mac Plugin 1.2.0 validates SSH host keys when connecting to agents.

CSRF vulnerability and missing permission checks in Mac Plugin

SECURITY-1761 / CVE-2020-2147 (CSRF), CVE-2020-2148 (missing permission check)
Severity (CVSS): Medium
Affected plugin: mac
Description:

Mac Plugin 1.1.0 and earlier does not perform permission checks on a method implementing form validation. This allows users with Overall/Read access to Jenkins to connect to an attacker-specified SSH host using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

This form validation method requires POST requests and Overall/Administer permission in Mac Plugin 1.2.0.

Credentials transmitted in plain text by Repository Connector Plugin

SECURITY-1520 / CVE-2020-2149
Severity (CVSS): Low
Affected plugin: repository-connector
Description:

Repository Connector Plugin stores credentials in its global configuration file org.jvnet.hudson.plugins.repositoryconnector.RepositoryConfiguration.xml on the Jenkins controller as part of its configuration.

While the credentials are stored encrypted on disk, they are transmitted in plain text as part of the configuration form by Repository Connector Plugin 1.2.6 and earlier. This can result in exposure of the credential through browser extensions, cross-site scripting vulnerabilities, and similar situations.

As of publication of this advisory, there is no fix.

Credentials transmitted in plain text by Sonar Quality Gates Plugin

SECURITY-1523 / CVE-2020-2150
Severity (CVSS): Low
Affected plugin: sonar-quality-gates
Description:

Sonar Quality Gates Plugin stores credentials in its global configuration file org.quality.gates.jenkins.plugin.GlobalConfig.xml on the Jenkins controller as part of its configuration.

While the credentials are stored encrypted on disk, they are transmitted in plain text as part of the configuration form by Sonar Quality Gates Plugin 1.3.1 and earlier. This can result in exposure of the credential through browser extensions, cross-site scripting vulnerabilities, and similar situations.

As of publication of this advisory, there is no fix.

Credentials transmitted in plain text by Quality Gates Plugin

SECURITY-1519 / CVE-2020-2151
Severity (CVSS): Low
Affected plugin: quality-gates
Description:

Quality Gates Plugin stores credentials in its global configuration file quality.gates.jenkins.plugin.GlobalConfig.xml on the Jenkins controller as part of its configuration.

While the credentials are stored encrypted on disk, they are transmitted in plain text as part of the configuration form by Quality Gates Plugin 2.5 and earlier. This can result in exposure of the credential through browser extensions, cross-site scripting vulnerabilities, and similar situations.

As of publication of this advisory, there is no fix.

XSS vulnerability in Subversion Release Manager Plugin

SECURITY-1727 / CVE-2020-2152
Severity (CVSS): Medium
Affected plugin: svn-release-mgr
Description:

Subversion Release Manager Plugin 1.2 and earlier does not escape the error message for the Repository URL field form validation.

This results in a reflected cross-site scripting vulnerability that can also be exploited similar to a stored cross-site scripting vulnerability by users with Job/Configure permission.

As of publication of this advisory, there is no fix.

Credentials transmitted in plain text by Backlog Plugin

SECURITY-1510 / CVE-2020-2153
Severity (CVSS): Low
Affected plugin: backlog
Description:

Backlog Plugin stores credentials in job config.xml files as part of its configuration.

While the credentials are stored encrypted on disk, they are transmitted in plain text as part of the configuration form by Backlog Plugin 2.4 and earlier. These credentials could be viewed by users with Extended Read permission.

As of publication of this advisory, there is no fix.

Credentials stored in plain text by Zephyr for JIRA Test Management Plugin

SECURITY-1550 / CVE-2020-2154
Severity (CVSS): Low
Affected plugin: zephyr-for-jira-test-management
Description:

Zephyr for JIRA Test Management Plugin 1.5 and earlier stores Jira credentials unencrypted in its global configuration file com.thed.zephyr.jenkins.reporter.ZfjReporter.xml on the Jenkins controller. These credentials can be viewed by users with access to the Jenkins controller file system.

As of publication of this advisory, there is no fix.

Credentials transmitted in plain text by OpenShift Deployer Plugin

SECURITY-1518 / CVE-2020-2155
Severity (CVSS): Low
Affected plugin: openshift-deployer
Description:

OpenShift Deployer Plugin stores credentials in its global configuration file org.jenkinsci.plugins.openshift.DeployApplication.xml on the Jenkins controller as part of its configuration.

While the credentials are stored encrypted on disk, they are transmitted in plain text as part of the configuration form by OpenShift Deployer Plugin 1.2.0 and earlier. This can result in exposure of the credential through browser extensions, cross-site scripting vulnerabilities, and similar situations.

As of publication of this advisory, there is no fix.

Credentials transmitted in plain text by DeployHub Plugin

SECURITY-1511 / CVE-2020-2156
Severity (CVSS): Low
Affected plugin: deployhub
Description:

DeployHub Plugin stores credentials in job config.xml files as part of its configuration.

While the credentials are stored encrypted on disk, they are transmitted in plain text as part of the configuration form by DeployHub Plugin 8.0.14 and earlier. These credentials could be viewed by users with Extended Read permission.

As of publication of this advisory, there is no fix.

Credentials transmitted in plain text by Skytap Cloud CI Plugin

SECURITY-1522 / CVE-2020-2157
Severity (CVSS): Low
Affected plugin: skytap
Description:

Skytap Cloud CI Plugin stores credentials in job config.xml files as part of its configuration.

While the credentials are stored encrypted on disk, they are transmitted in plain text as part of the configuration form by Skytap Cloud CI Plugin 2.07 and earlier. These credentials could be viewed by users with Extended Read permission.

As of publication of this advisory, there is no fix.

RCE vulnerability in Literate Plugin

SECURITY-1750 / CVE-2020-2158
Severity (CVSS): High
Affected plugin: literate
Description:

Literate Plugin 1.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types. This results in a remote code execution vulnerability exploitable by users able to provide YAML input files to Literate Plugin’s build step.

As of publication of this advisory, there is no fix.

OS command injection in CryptoMove Plugin

SECURITY-1635 / CVE-2020-2159
Severity (CVSS): High
Affected plugin: cryptomove
Description:

CryptoMove Plugin 0.1.33 and earlier allows the configuration of an OS command to execute as part of its build step configuration.

This command will be executed on the Jenkins controller as the OS user account running Jenkins, allowing user with Job/Configure permission to execute an arbitrary OS command on the Jenkins controller.

As of publication of this advisory, there is no fix.

Severity

• SECURITY-1510: Low
• SECURITY-1511: Low
• SECURITY-1516: Low
• SECURITY-1518: Low
• SECURITY-1519: Low
• SECURITY-1520: Low
• SECURITY-1522: Low
• SECURITY-1523: Low
• SECURITY-1550: Low
• SECURITY-1596: Low
• SECURITY-1635: High
• SECURITY-1668: Medium
• SECURITY-1692: Medium
• SECURITY-1700: High
• SECURITY-1702: High
• SECURITY-1722: Medium
• SECURITY-1723: Medium
• SECURITY-1727: Medium
• SECURITY-1750: High
• SECURITY-1754: High
• SECURITY-1761: Medium
• SECURITY-1765: Medium
• SECURITY-1784: Medium

Affected Versions

• Audit Trail Plugin up to and including 3.2
• Backlog Plugin up to and including 2.4
• Cobertura Plugin up to and including 1.15
• CryptoMove Plugin up to and including 0.1.33
• DeployHub Plugin up to and including 8.0.14
• Git Plugin up to and including 4.2.0
• Literate Plugin up to and including 1.0
• Logstash Plugin up to and including 2.3.1
• Mac Plugin up to and including 1.1.0
• OpenShift Deployer Plugin up to and including 1.2.0
• P4 Plugin up to and including 1.10.10
• Quality Gates Plugin up to and including 2.5
• Repository Connector Plugin up to and including 1.2.6
• Rundeck Plugin up to and including 3.6.6
• Script Security Plugin up to and including 1.70
• Skytap Cloud CI Plugin up to and including 2.07
• Sonar Quality Gates Plugin up to and including 1.3.1
• Subversion Release Manager Plugin up to and including 1.2
• Timestamper Plugin up to and including 1.11.1
• Zephyr Enterprise Test Management Plugin up to and including 1.9.1
• Zephyr for JIRA Test Management Plugin up to and including 1.5

Fix

• Audit Trail Plugin should be updated to version 3.3
• Cobertura Plugin should be updated to version 1.16
• Git Plugin should be updated to version 4.2.1
• Logstash Plugin should be updated to version 2.3.2
• Mac Plugin should be updated to version 1.2.0
• P4 Plugin should be updated to version 1.10.11
• Rundeck Plugin should be updated to version 3.6.7
• Script Security Plugin should be updated to version 1.71
• Timestamper Plugin should be updated to version 1.11.2
• Zephyr Enterprise Test Management Plugin should be updated to version 1.10

These versions include fixes to the vulnerabilities described above. All prior versions are considered to be affected by these vulnerabilities unless otherwise indicated.

As of publication of this advisory, no fixes are available for the following plugins:

• Backlog Plugin
• CryptoMove Plugin
• DeployHub Plugin
• Literate Plugin
• OpenShift Deployer Plugin
• Quality Gates Plugin
• Repository Connector Plugin
• Skytap Cloud CI Plugin
• Sonar Quality Gates Plugin
• Subversion Release Manager Plugin
• Zephyr for JIRA Test Management Plugin

Learn why we announce these issues.

Credit

The Jenkins project would like to thank the reporters for discovering and reporting these vulnerabilities:

• Cheng Gao, Alibaba Cloud Intelligence Security Team, https://www.aliyun.com/ for SECURITY-1702
• Federico Pellegrin for SECURITY-1668, SECURITY-1700
• Ian Williams for SECURITY-1596
• James Holderness, IB Boost for SECURITY-1510, SECURITY-1511, SECURITY-1516, SECURITY-1518, SECURITY-1519, SECURITY-1520, SECURITY-1522, SECURITY-1523, SECURITY-1550
• Nils Emmerich of ERNW Research GmbH for SECURITY-1754
• Raihaan Shouhell, Autodesk, Inc for SECURITY-1692
• Wadeck Follonier, CloudBees, Inc. for SECURITY-1722, SECURITY-1723, SECURITY-1727, SECURITY-1761, SECURITY-1765, SECURITY-1784
• Wasin Saengow for SECURITY-1635