CVE-2019-10443: Jenkins Security Advisory 2019-10-16

This advisory announces vulnerabilities in the following Jenkins deliverables:

• Bumblebee HP ALM Plugin
• Cadence vManager Plugin
• CRX Content Package Deployer Plugin
• Delphix Plugin
• ElasticBox CI Plugin
• Extensive Testing Plugin
• Fortify on Demand Plugin
• Google Kubernetes Engine Plugin
• Google OAuth Credentials Plugin
• iceScrum Plugin
• NeoLoad Plugin
• Oracle Cloud Infrastructure Compute Classic Plugin
• Puppet Enterprise Pipeline Plugin
• Rundeck Plugin
• SOASTA CloudTest Plugin
• Sofy.AI Plugin
• View26 Test-Reporting Plugin

Descriptions****Arbitrary file read vulnerability in Google OAuth Credentials Plugin

SECURITY-1583 / CVE-2019-10436
Severity (CVSS): Medium
Affected plugin: google-oauth-plugin
Description:

Google OAuth Credentials Plugin allowed the creation of credentials based on the content of files on the Jenkins controller through a feature retaining backwards compatibility with earlier plugin releases. This allowed users with the permission to configure jobs and credentials to read arbitrary files on the Jenkins controller by creating a credential referencing an arbitrary file on the Jenkins controller.

Google OAuth Credentials Plugin no longer allows a regular user to create credentials in the legacy format.

CSRF vulnerability and missing permission check in CRX Content Package Deployer Plugin allowed capturing credentials

SECURITY-1006 (1) / CVE-2019-10437 (CSRF), CVE-2019-10438 (permission check)
Severity (CVSS): High
Affected plugin: crx-content-package-deployer
Description:

CRX Content Package Deployer Plugin did not perform permission checks on a method implementing form validation. This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, the form validation method did not require POST requests, resulting in a CSRF vulnerability.

CRX Content Package Deployer Plugin now requires POST requests and Item/Configure permission.

Users with Overall/Read access could enumerate credential IDs in CRX Content Package Deployer Plugin

SECURITY-1006 (2) / CVE-2019-10439
Severity (CVSS): Medium
Affected plugin: crx-content-package-deployer
Description:

CRX Content Package Deployer Plugin provides a list of applicable credential IDs to allow users configuring the plugin to select the one to use.

This functionality did not correctly check permissions, allowing any user with Overall/Read permission to get a list of valid credentials IDs. Those could be used as part of an attack to capture the credentials using another vulnerability.

An enumeration of credentials IDs in CRX Content Package Deployer Plugin now requires the appropriate permission.

NeoLoad Plugin stored credentials in plain text

SECURITY-1427 / CVE-2019-10440
Severity (CVSS): Medium
Affected plugin: neoload-jenkins-plugin
Description:

NeoLoad Plugin stored credentials unencrypted in its global configuration file org.jenkinsci.plugins.neoload.integration.NeoGlobalConfig.xml and in job config.xml files on the Jenkins controller. These credentials could be viewed by users with Extended Read permission or access to the Jenkins controller file system.

NeoLoad Plugin now stores these credentials encrypted.

CSRF vulnerability and missing permission check in iceScrum Plugin

SECURITY-1484 / CVE-2019-10441 (CSRF), CVE-2019-10442 (permission check)
Severity (CVSS): Medium
Affected plugin: icescrum
Description:

iceScrum Plugin did not perform permission checks on a method implementing form validation. This allowed users with Overall/Read access to Jenkins to initiate a connection test to an attacker-specified server with attacker-specified access token or username and password.

Additionally, the form validation method did not require POST requests, resulting in a CSRF vulnerability.

iceScrum Plugin now requires POST requests and Overall/Administer permission.

iceScrum Plugin stored credentials in plain text

SECURITY-1436 / CVE-2019-10443
Severity (CVSS): Medium
Affected plugin: icescrum
Description:

iceScrum Plugin stored credentials unencrypted in job config.xml files on the Jenkins controller. These credentials could be viewed by users with Extended Read permission or access to the Jenkins controller file system.

iceScrum Plugin 1.1.5 and newer now stores these credentials encrypted.

Bumblebee HP ALM Plugin unconditionally disabled SSL/TLS certificate validation

SECURITY-1481 / CVE-2019-10444
Severity (CVSS): Medium
Affected plugin: bumblebee
Description:

Bumblebee HP ALM Plugin unconditionally disabled SSL/TLS certificate validation for connections to the HP ALM service.

Bumblebee HP ALM Plugin no longer does that. Instead, it now allows users to opt out of certificate validation.

Missing permission checks in Google Kubernetes Engine Plugin allowed validating and obtaining data

SECURITY-1607 / CVE-2019-10445
Severity (CVSS): Low
Affected plugin: google-kubernetes-engine
Description:

Missing permission checks in Google Kubernetes Engine Plugin allowed users with Overall/Read permission to obtain limited information about the scope and access of a credential with an attacker-specified credential ID obtained through another method.

Google Kubernetes Engine Plugin now requires Job/Configure permission for these operations.

Cadence vManager Plugin globally and unconditionally disabled SSL/TLS certificate validation

SECURITY-1615 / CVE-2019-10446
Severity (CVSS): Medium
Affected plugin: vmanager-plugin
Description:

Cadence vManager Plugin unconditionally disabled SSL/TLS certificate validation for the entire Jenkins controller JVM.

Cadence vManager Plugin no longer does that. Instead, it now has an opt-in option to ignore SSL/TLS errors for its connections.

Script sandbox bypass vulnerability in Puppet Enterprise Pipeline Plugin

SECURITY-918 / CVE-2019-10458
Severity (CVSS): High
Affected plugin: puppet-enterprise-pipeline
Description:

Puppet Enterprise Pipeline Plugin defines a custom list of pre-approved signatures for all scripts protected by the Script Security sandbox.

This custom list of pre-approved signatures allows the use of methods that can be used to bypass Script Security sandbox protection. This results in arbitrary code execution on any Jenkins instance with this plugin installed.

As of publication of this advisory there is no fix.

Sofy.AI Plugin stores API token in plain text

SECURITY-1431 / CVE-2019-10447
Severity (CVSS): Medium
Affected plugin: sofy-ai
Description:

Sofy.AI Plugin stores an API token unencrypted in job config.xml files on the Jenkins controller. This token can be viewed by users with Extended Read permission or access to the Jenkins controller file system.

As of publication of this advisory there is no fix.

Extensive Testing Plugin stores credentials in plain text

SECURITY-1432 / CVE-2019-10448
Severity (CVSS): Medium
Affected plugin: extensivetesting
Description:

Extensive Testing Plugin stores credentials unencrypted in job config.xml files on the Jenkins controller. These credentials can be viewed by users with Extended Read permission or access to the Jenkins controller file system.

As of publication of this advisory there is no fix.

Fortify on Demand Plugin stores credentials in plain text

SECURITY-1433 / CVE-2019-10449
Severity (CVSS): Medium
Affected plugin: fortify-on-demand-uploader
Description:

Fortify on Demand Plugin stores credentials unencrypted in job config.xml files on the Jenkins controller. These credentials can be viewed by users with Extended Read permission or access to the Jenkins controller file system.

As of publication of this advisory there is no fix.

ElasticBox CI Plugin stores access token in plain text

SECURITY-1434 / CVE-2019-10450
Severity (CVSS): Low
Affected plugin: elasticbox
Description:

ElasticBox CI Plugin stores an access token unencrypted in the global config.xml configuration file on the Jenkins controller. This token can be viewed by users with access to the Jenkins controller file system.

As of publication of this advisory there is no fix.

SOASTA CloudTest Plugin stores API token in plain text

SECURITY-1439 / CVE-2019-10451
Severity (CVSS): Medium
Affected plugin: cloudtest
Description:

SOASTA CloudTest Plugin stores credentials unencrypted in its global configuration file com.soasta.jenkins.CloudTestServer.xml on the Jenkins controller. These credentials could be viewed by users with access to the Jenkins controller file system.

As of publication of this advisory there is no fix.

View26 Test-Reporting Plugin stores access token in plain text

SECURITY-1440 / CVE-2019-10452
Severity (CVSS): Medium
Affected plugin: view26
Description:

View26 Test-Reporting Plugin stores an access token unencrypted in job config.xml files on the Jenkins controller. This token can be viewed by users with Extended Read permission or access to the Jenkins controller file system.

As of publication of this advisory there is no fix.

Delphix Plugin stores credentials in plain text

SECURITY-1450 / CVE-2019-10453
Severity (CVSS): Low
Affected plugin: delphix
Description:

Delphix Plugin stores credentials unencrypted in its global configuration file io.jenkins.plugins.delphix.GlobalConfiguration.xml on the Jenkins controller. These credentials could be viewed by users with access to the Jenkins controller file system.

As of publication of this advisory there is no fix.

CSRF vulnerability and missing permission check in Rundeck Plugin

SECURITY-1460 / CVE-2019-10454 (CSRF), CVE-2019-10455 (permission check)
Severity (CVSS): Medium
Affected plugin: rundeck
Description:

Rundeck Plugin does not perform permission checks on a method implementing form validation. This allows users with Overall/Read access to Jenkins to initiate a connection test to an attacker-specified server with attacker-specified username and password.

Additionally, the form validation method does not require POST requests, resulting in a CSRF vulnerability.

As of publication of this advisory there is no fix.

CSRF vulnerability and missing permission check in Oracle Cloud Infrastructure Compute Classic Plugin

SECURITY-1462 / CVE-2019-10456 (CSRF), CVE-2019-10457 (permission check)
Severity (CVSS): Medium
Affected plugin: oracle-cloud-infrastructure-compute-classic
Description:

Oracle Cloud Infrastructure Compute Classic Plugin does not perform permission checks on a method implementing form validation. This allows users with Overall/Read access to Jenkins to initiate a connection test to an attacker-specified server with attacker-specified username and password.

Additionally, the form validation method does not require POST requests, resulting in a CSRF vulnerability.

As of publication of this advisory there is no fix.

Severity

• SECURITY-918: High
• SECURITY-1006 (1): High
• SECURITY-1006 (2): Medium
• SECURITY-1427: Medium
• SECURITY-1431: Medium
• SECURITY-1432: Medium
• SECURITY-1433: Medium
• SECURITY-1434: Low
• SECURITY-1436: Medium
• SECURITY-1439: Medium
• SECURITY-1440: Medium
• SECURITY-1450: Low
• SECURITY-1460: Medium
• SECURITY-1462: Medium
• SECURITY-1481: Medium
• SECURITY-1484: Medium
• SECURITY-1583: Medium
• SECURITY-1607: Low
• SECURITY-1615: Medium

Affected Versions

• Bumblebee HP ALM Plugin up to and including 4.1.3
• Cadence vManager Plugin up to and including 2.7.0
• CRX Content Package Deployer Plugin up to and including 1.8.1
• Delphix Plugin up to and including 2.0.4
• ElasticBox CI Plugin up to and including 5.0.1
• Extensive Testing Plugin up to and including 1.4.4b
• Fortify on Demand Plugin up to and including 4.0.0
• Google Kubernetes Engine Plugin up to and including 0.7.0
• Google OAuth Credentials Plugin up to and including 0.9
• iceScrum Plugin up to and including 1.1.5
• NeoLoad Plugin up to and including 2.2.5
• Oracle Cloud Infrastructure Compute Classic Plugin up to and including 1.0.0
• Puppet Enterprise Pipeline Plugin up to and including 1.3.1
• Rundeck Plugin up to and including 3.6.5
• SOASTA CloudTest Plugin up to and including 2.25
• Sofy.AI Plugin up to and including 1.0.3
• View26 Test-Reporting Plugin up to and including 1.0.7

Fix

• Bumblebee HP ALM Plugin should be updated to version 4.1.4
• Cadence vManager Plugin should be updated to version 2.7.1
• CRX Content Package Deployer Plugin should be updated to version 1.9
• Google Kubernetes Engine Plugin should be updated to version 0.7.1
• Google OAuth Credentials Plugin should be updated to version 0.10
• iceScrum Plugin should be updated to version 1.1.6
• NeoLoad Plugin should be updated to version 2.2.6

These versions include fixes to the vulnerabilities described above. All prior versions are considered to be affected by these vulnerabilities unless otherwise indicated.

As of publication of this advisory, no fixes are available for the following plugins:

• Delphix Plugin
• ElasticBox CI Plugin
• Extensive Testing Plugin
• Fortify on Demand Plugin
• Oracle Cloud Infrastructure Compute Classic Plugin
• Puppet Enterprise Pipeline Plugin
• Rundeck Plugin
• SOASTA CloudTest Plugin
• Sofy.AI Plugin
• View26 Test-Reporting Plugin

Learn why we announce these issues.

Credit

The Jenkins project would like to thank the reporters for discovering and reporting these vulnerabilities:

• Daniel Beck, CloudBees, Inc. for SECURITY-1615
• David Fiser of Trend Micro Nebula working with Trend Micro’s Zero Day Initiative for SECURITY-1427, SECURITY-1431, SECURITY-1432, SECURITY-1433, SECURITY-1434, SECURITY-1436, SECURITY-1439, SECURITY-1440, SECURITY-1450
• Jesse Glick, CloudBees, Inc. for SECURITY-918
• Matt Sicker, CloudBees Inc. for SECURITY-1607
• Oleg Nenashev, CloudBees, Inc. for SECURITY-1006 (1), SECURITY-1006 (2)
• Viktor Gazdag NCC Group for SECURITY-1460, SECURITY-1462, SECURITY-1481, SECURITY-1484
• Wadeck Follonier, Jesse Glick, and Daniel Beck, CloudBees, Inc. for SECURITY-1583