CVE-2022-27206: Jenkins Security Advisory 2022-03-15

This advisory announces vulnerabilities in the following Jenkins deliverables:

• CloudBees AWS Credentials Plugin
• Dashboard View Plugin
• dbCharts Plugin
• Environment Dashboard Plugin
• Extended Choice Parameter Plugin
• Favorite Plugin
• Folder-based Authorization Strategy Plugin
• GitLab Authentication Plugin
• global-build-stats Plugin
• incapptic connect uploader Plugin
• kubernetes-cd Plugin
• List Git Branches Parameter Plugin
• Parameterized Trigger Plugin
• Release Helper Plugin
• Semantic Versioning Plugin
• Vmware vRealize CodeStream Plugin

Descriptions****Sensitive parameter values captured in build metadata files by Parameterized Trigger Plugin

SECURITY-2185 / CVE-2022-27195
Severity (CVSS): Low
Affected plugin: parameterized-trigger
Description:

Parameterized Trigger Plugin 2.43 and earlier captures environment variables passed to builds triggered using Parameterized Trigger Plugin, including password parameter values, in their build.xml files. These values are stored unencrypted and can be viewed by users with access to the Jenkins controller file system.

Parameterized Trigger Plugin 2.43.1 does not store captured environment variables in build.xml files.

Existing build.xml files are not automatically updated to remove captured environment variables. They need to be manually cleaned up. To help with this, the plugin will report environment variables stored in build.xml as unloadable data in the Old Data Monitor, that allows discarding this data. Build records are only loaded from disk when needed however, so some builds stored in Jenkins may not immediately appear there.

Stored XSS vulnerability in Favorite Plugin

SECURITY-2557 / CVE-2022-27196
Severity (CVSS): High
Affected plugin: favorite
Description:

Favorite Plugin 2.4.0 and earlier does not escape the names of jobs in the favorite column.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure or Item/Create permissions.

Favorite Plugin 2.4.1 escapes the names of jobs in the favorite column.

Stored XSS vulnerability in Dashboard View Plugin

SECURITY-2559 / CVE-2022-27197
Severity (CVSS): High
Affected plugin: dashboard-view
Description:

Dashboard View Plugin 2.18 and earlier does not perform URL validation for the Iframe Portlet’s Iframe source URL.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure views.

Dashboard View Plugin 2.18.1 performs URL validation for the Iframe Portlet’s Iframe source URL.

Additionally, Dashboard View Plugin 2.18.1 sets the sandbox attribute for the iframe to restrict the included page.

In case of problems, the Java system property hudson.plugins.view.dashboard.core.IframePortlet.sandboxAttributeValue can be used to customize the sandbox attribute value. The Java system property hudson.plugins.view.dashboard.core.IframePortlet.doNotUseSandbox can be used to disable the sandbox completely.

CSRF vulnerability and missing permission checks in CloudBees AWS Credentials Plugin

SECURITY-2351 / CVE-2022-27198 (CSRF), CVE-2022-27199 (permission check)
Severity (CVSS): Medium
Affected plugin: aws-credentials
Description:

CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

This form validation method requires POST requests and Overall/Administer permission in CloudBees AWS Credentials Plugin 191.vcb_f183ce58b_9.

Stored XSS vulnerability in Folder-based Authorization Strategy Plugin

SECURITY-2646 / CVE-2022-27200
Severity (CVSS): Medium
Affected plugin: folder-auth
Description:

Folder-based Authorization Strategy Plugin 1.3 and earlier does not escape the names of roles shown on the configuration form.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer permission.

Folder-based Authorization Strategy Plugin 1.4 escapes the names of roles shown on the configuration form.

Agent-to-controller security bypass in Semantic Versioning Plugin

SECURITY-2124 / CVE-2022-27201
Severity (CVSS): High
Affected plugin: semantic-versioning-plugin
Description:

Semantic Versioning Plugin defines a controller/agent message that processes a given file as XML and returns version information. The XML parser is not configured to prevent XML external entity (XXE) attacks, which is only a problem if XML documents are parsed on the Jenkins controller.

Semantic Versioning Plugin 1.13 and earlier does not restrict execution of the controller/agent message to agents, and implements no limitations about the file path that can be parsed. This allows attackers able to control agent processes to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

This vulnerability is only exploitable in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. See the LTS upgrade guide.

Semantic Versioning Plugin 1.14 does not allow the affected controller/agent message to be submitted by agents for execution on the controller.

Stored XSS vulnerability in Extended Choice Parameter Plugin

SECURITY-2232 / CVE-2022-27202
Severity (CVSS): High
Affected plugin: extended-choice-parameter
Description:

Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier does not escape the value and description of Extended Choice Parameters with parameter type ‘Radio Buttons’ or 'Check Boxes’.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Arbitrary JSON and property file read vulnerability in Extended Choice Parameter Plugin

SECURITY-1351 / CVE-2022-27203
Severity (CVSS): Medium
Affected plugin: extended-choice-parameter
Description:

Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers with Item/Configure permission to read values from arbitrary JSON and Java properties files on the Jenkins controller.

CSRF vulnerability and missing permission checks in Extended Choice Parameter Plugin allow SSRF

SECURITY-1350 / CVE-2022-27204 (CSRF), CVE-2022-27205 (permission check)
Severity (CVSS): Medium
Affected plugin: extended-choice-parameter
Description:

Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier does not perform a permission check on form validation methods. This allows attackers with Overall/Read permission to connect to an attacker-specified URL.

Additionally, these form validation methods do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

Client Secret stored in plain text by GitLab Authentication Plugin

SECURITY-1891 / CVE-2022-27206
Severity (CVSS): Low
Affected plugin: gitlab-oauth
Description:

GitLab Authentication Plugin 1.13 and earlier stores the GitLab client secret unencrypted in the global config.xml file on the Jenkins controller as part of its configuration.

This client secret can be viewed by users with access to the Jenkins controller file system.

Stored XSS vulnerability in global-build-stats Plugin

SECURITY-1886 / CVE-2022-27207
Severity (CVSS): Medium
Affected plugin: global-build-stats
Description:

global-build-stats Plugin 1.5 and earlier does not escape multiple fields in the chart configuration on the ‘Global Build Stats’ page.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer permission.

Arbitrary file read vulnerability in kubernetes-cd Plugin

SECURITY-2096 / CVE-2022-27208
Severity (CVSS): Medium
Affected plugin: kubernetes-cd
Description:

kubernetes-cd Plugin contributes the 'Kubernetes configuration (kubeconfig)' credential type.

kubernetes-cd Plugin 2.3.1 and earlier allows users with Credentials/Create or Credentials/Update permission to read arbitrary files on the Jenkins controller by defining a ‘From a file on the Jenkins master’ Kubeconfig source for such a credential.

Missing permission checks in kubernetes-cd Plugin allow enumerating credentials IDs

SECURITY-2636 / CVE-2022-27209
Severity (CVSS): Medium
Affected plugin: kubernetes-cd
Description:

kubernetes-cd Plugin 2.3.1 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

CSRF vulnerability and missing permission checks in kubernetes-cd Plugin allow capturing credentials

SECURITY-2681 / CVE-2022-27210 (CSRF), CVE-2022-27211 (permission check)
Severity (CVSS): High
Affected plugin: kubernetes-cd
Description:

kubernetes-cd Plugin 2.3.1 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, this endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

Stored XSS vulnerability in List Git Branches Parameter Plugin

SECURITY-2167 / CVE-2022-27212
Severity (CVSS): High
Affected plugin: list-git-branches-parameter
Description:

List Git Branches Parameter Plugin 0.0.9 and earlier does not escape the name or default value of the 'List Git branches (and more)' parameter. Additionally, List Git Branches Parameter Plugin explicitly disables a protection mechanism introduced in Jenkins 2.44 and LTS 2.32.2 to prevent exploitation of unescaped parameter names.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Stored XSS vulnerability in Environment Dashboard Plugin

SECURITY-2252 / CVE-2022-27213
Severity (CVSS): High
Affected plugin: environment-dashboard
Description:

Environment Dashboard Plugin 1.1.10 and earlier does not escape the Environment order and the Component order configuration values in its views.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Configure permission.

CSRF vulnerability and missing permission checks in Release Helper Plugin

SECURITY-2274 / CVE-2022-27214 (CSRF), CVE-2022-27215 (permission check)
Severity (CVSS): Medium
Affected plugin: release-helper
Description:

Release Helper Plugin 1.3.3 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

Passwords stored in plain text by dbCharts Plugin

SECURITY-2159 / CVE-2022-27216
Severity (CVSS): Low
Affected plugin: dbCharts
Description:

dbCharts Plugin 0.5.2 and earlier stores JDBC connection passwords unencrypted in its global configuration file hudson.plugins.dbcharts.DbChartPublisher.xml on the Jenkins controller as part of its configuration.

These passwords can be viewed by users with access to the Jenkins controller file system.

Passwords stored in plain text by Vmware vRealize CodeStream Plugin

SECURITY-2238 / CVE-2022-27217
Severity (CVSS): Medium
Affected plugin: vmware-vrealize-codestream
Description:

Vmware vRealize CodeStream Plugin 1.2 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller as part of its configuration.

These passwords can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

Personal tokens stored in plain text by incapptic connect uploader Plugin

SECURITY-2273 / CVE-2022-27218
Severity (CVSS): Medium
Affected plugin: incapptic-connect-uploader
Description:

incapptic connect uploader Plugin 1.15 and earlier stores personal tokens unencrypted in job config.xml files on the Jenkins controller as part of its configuration.

These tokens can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

Severity

• SECURITY-1350: Medium
• SECURITY-1351: Medium
• SECURITY-1886: Medium
• SECURITY-1891: Low
• SECURITY-2096: Medium
• SECURITY-2124: High
• SECURITY-2159: Low
• SECURITY-2167: High
• SECURITY-2185: Low
• SECURITY-2232: High
• SECURITY-2238: Medium
• SECURITY-2252: High
• SECURITY-2273: Medium
• SECURITY-2274: Medium
• SECURITY-2351: Medium
• SECURITY-2557: High
• SECURITY-2559: High
• SECURITY-2636: Medium
• SECURITY-2646: Medium
• SECURITY-2681: High

Affected Versions

• CloudBees AWS Credentials Plugin up to and including 189.v3551d5642995
• Dashboard View Plugin up to and including 2.18
• dbCharts Plugin up to and including 0.5.2
• Environment Dashboard Plugin up to and including 1.1.10
• Extended Choice Parameter Plugin up to and including 346.vd87693c5a_86c
• Favorite Plugin up to and including 2.4.0
• Folder-based Authorization Strategy Plugin up to and including 1.3
• GitLab Authentication Plugin up to and including 1.13
• global-build-stats Plugin up to and including 1.5
• incapptic connect uploader Plugin up to and including 1.15
• kubernetes-cd Plugin up to and including 2.3.1
• List Git Branches Parameter Plugin up to and including 0.0.9
• Parameterized Trigger Plugin up to and including 2.43
• Release Helper Plugin up to and including 1.3.3
• Semantic Versioning Plugin up to and including 1.13
• Vmware vRealize CodeStream Plugin up to and including 1.2

Fix

• CloudBees AWS Credentials Plugin should be updated to version 191.vcb_f183ce58b_9
• Dashboard View Plugin should be updated to version 2.18.1
• Favorite Plugin should be updated to version 2.4.1
• Folder-based Authorization Strategy Plugin should be updated to version 1.4
• Parameterized Trigger Plugin should be updated to version 2.43.1
• Semantic Versioning Plugin should be updated to version 1.14

These versions include fixes to the vulnerabilities described above. All prior versions are considered to be affected by these vulnerabilities unless otherwise indicated.

As of publication of this advisory, no fixes are available for the following plugins:

• dbCharts Plugin
• Environment Dashboard Plugin
• Extended Choice Parameter Plugin
• GitLab Authentication Plugin
• global-build-stats Plugin
• incapptic connect uploader Plugin
• kubernetes-cd Plugin
• List Git Branches Parameter Plugin
• Release Helper Plugin
• Vmware vRealize CodeStream Plugin

Learn why we announce these issues.

Credit

The Jenkins project would like to thank the reporters for discovering and reporting these vulnerabilities:

• Daniel Beck, CloudBees, Inc. for SECURITY-2124, SECURITY-2681
• Gunther Rademacher for SECURITY-2185
• Jesse Glick, CloudBees, Inc. for SECURITY-2096
• Justin Philip for SECURITY-2252
• Kevin Guerroudj for SECURITY-2232, SECURITY-2238
• Kevin Guerroudj, CloudBees, Inc. for SECURITY-2636, SECURITY-2646
• Kevin Guerroudj, CloudBees, Inc. and Wadeck Follonier, CloudBees, Inc. for SECURITY-2557
• Matt Sicker, CloudBees, Inc. and, independently, Marc Heyries for SECURITY-1891
• Oleg Nenashev, CloudBees, Inc. for SECURITY-1350, SECURITY-1351
• Quentin Parra for SECURITY-2273, SECURITY-2274
• Son Nguyen (@s0nnguy3n_) for SECURITY-2159
• Son Nguyen (@s0nnguy3n_), and, independently, Kevin Guerroudj for SECURITY-2167
• Wadeck Follonier, CloudBees, Inc. and Kevin Guerroudj, CloudBees, Inc. for SECURITY-2559
• Wadeck Follonier, CloudBees, Inc., and, independently, Kevin Guerroudj for SECURITY-1886