CVE-2020-2173: Jenkins Security Advisory 2020-04-07

This advisory announces vulnerabilities in the following Jenkins deliverables:

• AWSEB Deployment Plugin
• Code Coverage Plugin
• FitNesse Plugin
• Gatling Plugin
• useMango Runner Plugin

Descriptions****XXE vulnerability in Code Coverage Plugin

SECURITY-1699 / CVE-2020-2172
Severity (CVSS): High
Affected plugin: code-coverage-api
Description:

Code Coverage Plugin 1.1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. This allows a user able to control the input files for the “Publish Coverage Report” post-build step to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

Code Coverage Plugin 1.1.5 disables external entity resolution for its XML parser.

XSS vulnerability in Gatling Plugin

SECURITY-1633 / CVE-2020-2173
Severity (CVSS): Medium
Affected plugin: gatling
Description:

Gatling Plugin 1.2.7 and earlier serves Gatling reports in a manner that bypasses the Content-Security-Policy protection introduced in Jenkins 1.641 and 1.625.3. This results in a cross-site scripting (XSS) vulnerability exploitable by users able to change report content.

Gatling Plugin 1.3.0 no longer allows viewing Gatling reports directly in Jenkins. Instead users need to download an archive containing the report.

Reflected XSS vulnerability in AWSEB Deployment Plugin

SECURITY-1769 / CVE-2020-2174
Severity (CVSS): Medium
Affected plugin: awseb-deployment-plugin
Description:

AWSEB Deployment Plugin 0.3.19 and earlier does not escape various values printed as part of form validation output.

This results in a reflected cross-site scripting (XSS) vulnerability.

AWSEB Deployment Plugin 0.3.20 escapes the values printed as part of the affected form validation endpoints.

Stored XSS vulnerability in FitNesse Plugin

SECURITY-1801 / CVE-2020-2175
Severity (CVSS): Medium
Affected plugin: fitnesse
Description:

FitNesse Plugin 1.31 and earlier does not correctly escape report contents before showing them on the Jenkins UI.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by users able to control the XML input files processed by the plugin.

FitNesse Plugin 1.33 escapes content from XML input files before rendering it on the Jenkins UI.

XSS vulnerability in useMango Runner Plugin

SECURITY-1780 / CVE-2020-2176
Severity (CVSS): Medium
Affected plugin: usemango-runner
Description:

Multiple form validation endpoints in useMango Runner Plugin 1.4 and earlier do not escape values received from the useMango service.

This results in a cross-site scripting (XSS) vulnerability exploitable by users able to control the values returned from the useMango service.

useMango Runner Plugin 1.5 escapes all values received from the useMango service in form validation messages.

Severity

• SECURITY-1633: Medium
• SECURITY-1699: High
• SECURITY-1769: Medium
• SECURITY-1780: Medium
• SECURITY-1801: Medium

Affected Versions

• AWSEB Deployment Plugin up to and including 0.3.19
• Code Coverage Plugin up to and including 1.1.4
• FitNesse Plugin up to and including 1.31
• Gatling Plugin up to and including 1.2.7
• useMango Runner Plugin up to and including 1.4

Fix

• AWSEB Deployment Plugin should be updated to version 0.3.20
• Code Coverage Plugin should be updated to version 1.1.5
• FitNesse Plugin should be updated to version 1.33
• Gatling Plugin should be updated to version 1.3.0
• useMango Runner Plugin should be updated to version 1.5

These versions include fixes to the vulnerabilities described above. All prior versions are considered to be affected by these vulnerabilities unless otherwise indicated.

Credit

The Jenkins project would like to thank the reporters for discovering and reporting these vulnerabilities:

• Daniel Beck, CloudBees, Inc. for SECURITY-1633
• Federico Pellegrin for SECURITY-1699, SECURITY-1801
• Wadeck Follonier, CloudBees, Inc. for SECURITY-1769, SECURITY-1780