Access control vulnerability in Evoh NFT EvohClaimable contract with sha256 hash code fa2084d5abca91a62ed1d2f1cad3ec318e6a9a2d7f1510a00d898737b05f48ae allows remote attackers to execute fraudulent NFT transfers.

**CVE\_Evoh\_Contract**

These are the materials about the vulnerability of Evoh NFT contract

**PRODUCT**

EvohClaimable is a public smart contract running in the Ethereum blockchain. The source code of this contract is published in https://github.com/evoh-nft/evoh-erc721 by its developer. The information of the deployed contract is in https://etherscan.io/address/0xf883ab97ed3d5a9af062a65b6d4437ea015efd8a.

This contract is responsible for managing the expensive NFTs (Evoh Llama Frens), such as minting them, transfering them, etc.. These NFTs are sold on the famous NFT market Opensea here, and the total volume has been 39 ETH ($47435.50 USD) at the time when I write this document. This NFT project is still active now.

**Version**

This vulnerability is related to the latest version of this smart contract. The sha256 hash code of the smart contract is fa2084d5abca91a62ed1d2f1cad3ec318e6a9a2d7f1510a00d898737b05f48ae. Check it in the information of the deployed contract in https://etherscan.io/address/0xf883ab97ed3d5a9af062a65b6d4437ea015efd8a.

**PROBLEM TYPE**

Access control vulnerability

**DESCRIPTION**

Since in ERC-721 based NFT contract, when the contract executes the functions responsible for transferring NFT, such as **transferFrom(address \_from, address \_to, uint256 \_tokenId)** or **safeTransferFrom(address \_from, address \_to, uint256 \_tokenId)**, the contract will transfer the NFT whose ID is **\_tokenId** from account **\_from** to account **\_to**. In addition, these functions should emit the specific event **Transfer(address \_from, address \_to, uint256 \_tokenId)** to blockchain system, which enables the off-chain applications (such as NFT market, DApp) to perceive the transfer behaviour of NFT and synchronize it from blockchain. For example, the emitted event will be displayed in the market to inform user "the NFT whose ID is **\_tokenId** is transfered from **\_from** to **\_to**". For example, in the page, we can find the event displayed in the Item Activity tab.

This contract does not verify the parameter '\_from' of transferFrom and safeTransferFrom functions need to be the owner of NFT '\_tokenId'. This is a defect about access control: if the attacker Bob has the NFT '\_tokenId', he can transfer '\_tokenId' to Mike but he sets the the parameter '\_from' of transferFrom function to be Alice. Then transferFrom function will transfer the '\_tokenId' from Bob to Mike, but the emitted event will announce Alice transfers the NFT '\_tokenId' to Mike. That is, Bob is able to control the seller of NFT with any values, which can fake NFT transfer. Further, even if Bob is not the owner of NFT '\_tokenId', he can launch this attack if he is approved to sell the NFT. Therefore, this defect can lead to the sleep mint attack.

I also provide a PoC to reproduce this attack by deploying the same contract on the ganache. The steps to execute the PoC are as follow:

1.  activate the environment

$ git clone https://github.com/MacherCS/CVE\_Evoh\_Contract.git
$ cd CVE\_Evoh\_Contract
$ sudo docker build -t machercs/ganache:v1 .
$ sudo docker run --network host -it machercs/ganache:v1

2.  exploit the vulnerability and emit wrong event to announce fake transfer.

\[+\] The address of Bob is: 0x90F8bf6A479f320ead074411a4B0e7944Ea8c9C1
\[+\] The address of Alice is: 0xFFcf8FDEE72ac11b5c542428B35EEF5769C409f0
\[+\] The address of Mike is: 0x22d491Bde2303f2f43325b2108D26f1eAbA1e32b
...
\[+\] Bob mints NFT whose ID is 0
...
\[+\] The owner of NFT 0 is: 0x90F8bf6A479f320ead074411a4B0e7944Ea8c9C1
...
\[+\] Exploit end. The NFT 0 is transferred by Bob to Mike.
\[+\] The owner of NFT 0 is: 0x22d491Bde2303f2f43325b2108D26f1eAbA1e32b
\[+\] The Transfer events in blockchain:
...
{
  logIndex: 0,
  transactionIndex: 0,
  transactionHash: '0x5f29ad15f94935e6246d70fbff2fba919793a9163427e631620ea8ff8a48bcf3',
  blockHash: '0xa736e1b756066edf8186d497a21045a5a055c336055c4462de70a734863cf8a4',
  blockNumber: 6,
  address: '0xe78A0F7E598Cc8b0Bb87894B0F60dD2a88d6a8Ab',
  type: 'mined',
  removed: false,
  id: 'log\_8740b08f',
  returnValues: Result {
    '0': '0xFFcf8FDEE72ac11b5c542428B35EEF5769C409f0',
    '1': '0x22d491Bde2303f2f43325b2108D26f1eAbA1e32b',
    '2': '0',
    \_from: '0xFFcf8FDEE72ac11b5c542428B35EEF5769C409f0',
    \_to: '0x22d491Bde2303f2f43325b2108D26f1eAbA1e32b',
    \_tokenId: '0'
  },
  event: 'Transfer',
  signature: '0xddf252ad1be2c89b69c2b068fc378daa952ba7f163c4a11628f55a4df523b3ef',
  raw: {
    data: '0x',
    topics: \[
      '0xddf252ad1be2c89b69c2b068fc378daa952ba7f163c4a11628f55a4df523b3ef',
      '0x000000000000000000000000ffcf8fdee72ac11b5c542428b35eef5769c409f0',
      '0x00000000000000000000000022d491bde2303f2f43325b2108d26f1eaba1e32b',
      '0x0000000000000000000000000000000000000000000000000000000000000000'
    \]
  }
}
\[+\] Transfer(from:0xFFcf8FDEE72ac11b5c542428B35EEF5769C409f0, to:0x22d491Bde2303f2f43325b2108D26f1eAbA1e32b, tokenId:0)
\[+\] The last event records the NFT 0 is transferred from Alice to Mike (instead of from Bob to Mike).

**Additional explanation**

For the detail explanation of the exploit, please refer to the annotation of _poc.js_ file. The content of _evoh-erc721-master_ folder is the source code of EvohClaimable contract. The _CVE\_Evoh\_Contract/evoh-erc721-master/contracts/Claimable.sol_ is the code of deployed contract.

CVE-2022-35621: GitHub - MacherCS/CVE_Evoh_Contract: These are the materials about the vulnerability of Evoh NFT contract

In Keylime before 6.3.0, current keylime installer installs the keylime.conf file, which can contain sensitive data, as world-readable.

**oss-sec mailing list archives**

_From_: Matthias Gerstner <mgerstner () suse de>  
_Date_: Fri, 28 Jan 2022 13:57:23 +0100  

Hello list,

I have been reviewing the Keylime TPM remote attestation solution \[1\]
which resulted in a number of security related findings, including an
arbitrary remote code execution in the Keylime Agent component. The
upstream project published security advisories, fixes and an update
strategy to Keylime version 6.3.X today. Please find the details in the
following full report:

1) Scope of Review
==================

I've been looking into the four main components of Keylime: the Agent,
Registrar, Verifier and Tenant applications. I have been looking into
version 6.2.0. Any source code locations mentioned in this report relate
to this version.

2) Findings in the Agent Component
==================================

a) \`check\_mounted()\` Function Logic can be Fooled by Unprivileged Mounts (CVE-2022-23948)
-----------------------------------------------------------------------------------------

The \`check\_mounted()\` function in \`secure\_mount.py\` attempts to make
sure that a "secure" tmpfs is mounted at \`/var/lib/keylime/secure\` to
store sensitive data on that never gets written to disk. To do so the
function parses the output of the \`mount\` utility to determine whether
this file system is already mounted at the desired location.

There can exist the possibility of unprivileged users performing certain
mount operations, one of the most prominent examples being the
\`fusermount\` setuid-root binary for mounting FUSE file systems. In view
of this, parsing mount table output needs prudence. I described the
basic issue previously already in another report \[2\].

The following is a reproducer using \`fusermount\` that shows the basic local
attack vector:

    user$ export \_FUSE\_COMMFD=0
    user$ fusermount some/path/ -ononempty,fsname="tmpfs on /var/lib/keylime/secure"

This will fool the parsing logic in \`check\_mounted()\` and thus the
function assumes that the "secure" tmpfs is already mounted, while it
actually isn't.  Thus this will allow a local attacker on the system to
prevent this security feature to be effective, \*if\* the local attacker
manages to create such a mount entry before the \`keylime\_agent\` is
starting up.

The attack vector can also be used to perform a local DoS against
\`keylime\_agent\` by claiming a different \`fsname\` than tmpfs.
\`check\_mounted()\` will throw an Exception in this case and the Agent
won't start.

On a side note there are calls to \`secure\_mount.mount()\` spread
throughout the Keylime codebase (for example three times in
\`keylime\_agent.py\`, two times in \`tpm\_main.py\` and two times in
\`ca\_impl\_cfssl.py\`. There is no code to \*clean up\* this mount again,
however. So it potentially leaves behind a stale mount after services
are shutdown. Furthermore, if multiple Keylime processes should operate
in parallel this could result in a race condition where the "secure"
tmpfs is mounted twice, in the worst case mounting a fresh tmpfs over
previously stored content there.

My recommendation is to parse the \`/proc/self/mountinfo\` pseudo file for
mount table information instead. Whitespace is specially encoded in this
file. Furthermore the responsibility of mounting and unmounting this
file system should be more clearly defined during startup/shutdown of
processes and maybe a reference counting / locking scheme to prevent
race conditions should be used.

### Upstream Security Advisory

https://github.com/keylime/keylime/security/advisories/GHSA-wj36-qcfg-5j52

### Upstream Fixes

https://github.com/keylime/keylime/commit/1a4f31a6368d651222683c9debe7d6832db6f607
https://github.com/keylime/keylime/commit/d37c406e69cb6689baa2fb7964bad75209703724

b) Possible Information Leaks via Unauthenticated Agent Quote Interface
-----------------------------------------------------------------------

A TPM quote can be requested without authentication from the Agent service via
the network:

    $ curl "keyagent-host:9002/?api\_version=500&quotes=myquote&nonce=mynonce"
    {
        "code": 200,
        "status": "Success",
        "results": {
            "quote": <base64-data>, "hash\_alg": "sha256", "enc\_alg": "rsa", "sign\_alg": "rsassa",
            "pubkey": <PEM key>", "boottime": 1639999864
        }
    }

This exposes for example the \*boottime\* of the host where the Agent is
running, information that is not otherwise easily publicly available.
Furthermore: Could the contents of the TPM quote data also be
interesting data? Could it for example allow deductions about which kind
of operating system kernel is running on the host?

I recommend to somehow authenticate and cryptographically secure this
Agent interface to prevent information leaks of this kind.

### Upstream Fixes

This issue did not receive a dedicated CVE and fix. It is covered
together with the following issue 2.c).

c) Arbitrary Remote Code Execution in the Agent via Unauthenticated Bootstrap Interface (CVE-2021-43310)
--------------------------------------------------------------------------------------------------------

Note that this issue has been discovered in parallel also by Thore
Sommer, a Keylime upstream developer.

It looks like it is possible to simply post arbitrary new values for the
U and V key parts and provide a new configuration payload to the Agent,
only knowing the Agent's UUID. The Agent's UUID can be public or
semi-public information like when \`agent\_uuid=hostname\` is configured.
From the Keylime paper \[3\] (section 3.2.2) it sounds like the UUID HMAC
check is not considered a security feature but only a sanity check:

> This provides the node with a quick check to determine if Kb is correct.

When \`extract\_payload\_script=true\` (default) and
\`payload\_script=autorun.sh\` (default) are configured in \`keylime.conf\`
then the provided payload will be unzipped and a potentially contained
\`autorun.sh\` script is executed with full root privileges. Attached you
can find a reproducer script \`post\_key.py\` that demonstrates the issue
by creating a file \`/tmp/evil\` on the Agent host by only providing the
Agent hostname and UUID as input parameters.

Even if \`payload\_script\` is disabled then the extraction of a ZIP file
as \_root\_ might result in a remote root exploit by extracting files
outside of the intended target directory. I did not test this variant of
the attack vector, though. Furthermore by providing a ZIP bomb as
payload the Agent process can be subjected to a remote DoS through
memory exhaustion.

Retrieving the full symmetric key previously stored in
\`/var/lib/keylime/secure/derived\_tci\_key\` should not be possible this
way, because when performing the bootstrap protocol, the previous data
is removed in \`keylime\_agent.py:242\`. A skillful attacker might attempt
to first compromise the Agent node and then wait for the Tenant to
re-deploy the Agent using authentic keys and payload. Should this
succeed then the attacker can obtain the secret symmetric key from the
compromised Agent node after all.

Similar to issue b) I recommend to somehow authenticate and
cryptographically secure this Agent interface to prevent these attacks.
As a hotfix disabling the relevant configuration features should at
least prevent the remote code execution and memory exhaustion attack
vectors. Setting non-predictable UUID values can also help (but one
should also consider item 3.a in this context).  Even then this
interface still allows to disrupt the operational state of the Agent
host by simply overwriting its current configuration.

### Upstream Security Advisory

https://github.com/keylime/keylime/security/advisories/GHSA-2m39-75g9-ff5r

### Upstream Fixes

The fix consists of a larger number of upstream commits regarding
introduction of "mTLS" for the Agent interface. This means the
connection towards the Agent will in the future be cryptographically
secured and thus only trusted actors can use the Agent interface.

The upgrade path is a bit complicated because of this (see upstream
advisory).  Upstream version 6.3.X will introduce the new mTLS support
but not enforce it, to allow upgrading of all Keylime components on all
nodes. Only upstream version 6.4.x will enforce the new protocol.

d) Key Exchange and Bootstrap Protocol Susceptible to Replay Attacks
--------------------------------------------------------------------

Authentic payloads being passed from the Tenant to the Agent should be
reasonably safe from attackers (when not considering issue c)), since
the two halves of the symmetric key are encrypted using the per-agent
node RSA public key. The bootstrap protocol seems to be susceptible to
certain replay attacks, however. Since the interface does not employ
transport security, the bootstrap protocol can simply be recorded and
replayed to activate an authentic configuration payload. This could e.g.
be used by an attacker to activate an outdated or even insecure older
configuration of the Agent node.

### Upstream Fixes

This issue did not receive a dedicated CVE and fix. It is covered
together with the previous issue 2.c).

3) Findings in the Registrar Component
======================================

a) UUID of Agents is Received on Unprotected HTTP Interface
-----------------------------------------------------------

The Registrar provides two separate HTTP interfaces, a TLS protected one
and an unprotected one. Part of the unprotected interface is the Agent
registration.  As part of the Agent registration the Agent UUID is
passed unencrypted (processed in \`registrar\_common.py:229\`).

This is not a security issue in its own but relates to issue 2.c where
the knowledge of the UUID facilitates remote code execution on the Agent
nodes.  This means if an attacker can listen in on the Registrar's Agent
registration communication then even unpredictable Agent UUIDs no longer
hinder the attack described in issue 2.c).

As outlined in 2.c) the UUID does not seem to have been thought of as a
security property in the first place so I see no urge to change anything
here. Although when the bootstrap protocol should get TLS protection
then for completeness it could also make sense to protect this Registrar
interface as well the same way.

### Upstream Fixes

This specific aspect is covered by the following commit:

https://github.com/keylime/keylime/commit/e5f033c66403a899685b81a3af03cd59f76e455f

There is no dedicated CVE but it is covered together with the
overarching introduction of mTLS as outlined in issue 2.c).

b) Unsanitized UUID passed on Unprotected HTTP Interface Facilitates Log Spoofing (CVE-2022-23949)
--------------------------------------------------------------------------------------------------

Since the Registrar's unprotected HTTP interface requires no
authentication, anybody can post arbitrary Agent registrations with
arbitrary parameters. The Agent ID (UUID) parameter is not sanitized in
any way and is used unfiltered in log messages (e.g.
\`registrar\_common.py:107\`).

As a result the Agent ID parameter can be used to inject seemingly valid
additional log lines that appear e.g. in \`journalctl -u
keylime\_registrar.service\`. The attached reproducer script
\`post\_agent.py\` can be used to demonstrate this:

    $ ./post\_agent.py --host registrar-host --log-line "Please run rm -rf /\* to protect your system"

In the journal we will then see:

    Dec 21 11:44:22 registrar-host keylime\_registrar\[1426\]: 2021-12-21 11:44:22.281 - keylime.registrar - WARNING - 
POST for trusted-agent
    Dec 21 11:44:22 registrar-host keylime\_registrar\[1426\]: 2021-12-21 11:44:22.931 - keylime.registrar - WARNING - 
Please run rm -rf /\* to protect your system
    Dec 21 11:44:22 registrar-host keylime\_registrar\[1426\]: 2021-12-21 11:44:22.940 - keylime.registrar - DEBUG - 
returning 400 response. \[...\]

Such log spoofing could be used to entice Administrators to perform
actions that can be harmful or otherwise in the interest of an attacker.

My recommendation is on the one hand to diligently sanitize untrusted
input parameters. On the other hand it might make sense to authenticate
this currently untrusted interface.

### Upstream Advisory

https://github.com/keylime/keylime/security/advisories/GHSA-87gh-qc28-j9mm

### Upstream Fixes

The UUID sanitazion is introduced via these commits:

https://github.com/keylime/keylime/commit/387e320dc22c89f4f47c68cb37eb9eec2137f34b
https://github.com/keylime/keylime/commit/e429e95329fc60608713ddfb82f4a92ee3b3d2d9
https://github.com/keylime/keylime/commit/65c2b737129b5837f4a03660aeb1191ced275a57

Otherwise the introduction of mTLS as outlined in issues 3.a) and 2.c)
further protect this.

4) Findings in the Verifier Component
=====================================

a) Revocation Notifier Uses Fixed /tmp Path for UNIX Domain Socket (CVE-2022-23950)
-----------------------------------------------------------------------------------

In \*revocation\_notifier.py\* a fixed path in the world writable location
\*/tmp/keylime.verifier.ipc\* is used. The code (in this case the third
party \`zeromq\` Python module) forcefully removes any file object found
there earlier.  Should the program be running as non-root, or if another
local user simply places a \*directory\* at this location, then this
serves as a local DoS attack against the revocation notifier process,
because the socket cannot be created.

This situation doesn't even seem to be noticed by the Verifier main
process, because the child process \`broker\_proc\` is never waited on.
This means that the local attacker could even replace the "blocking"
directory by his own UNIX domain socket later on and will then receive
revocation events from invocations of the \`notify()\` function in the
main Verifier process.  The full impact of this would have to be
researched further. It looks like failed quote notifications would
longer be sent out.

I recommend to place UNIX domains sockets in a dedicated safe directory
in /run that cannot be staged with attacks by other local users in the
system.

### Upstream Advisory

https://github.com/keylime/keylime/security/advisories/GHSA-9r9r-f8xc-m875

### Upstream Fixes

This fix places the socket into a private /run/keylime directory:

https://github.com/keylime/keylime/commit/ea5d0373fa2c050d5d95404eb779be7e8327b911

b) Get Quote Response Contains Possibly Untrusted ZIP Data (CVE-2022-23951)
---------------------------------------------------------------------------

The Verifier process periodically performs quote operations on
registered Agents. As part of this \`process\_quote\_response()\` is called
and furthermore \`check\_quote()\` and finally \`\_tpm2\_checkquote()\`. In
\`tpm\_main.py:1018\` a couple of ZIP data streams are uncompressed via
\`zlib.decompress()\`.

Since this is processing possibly untrusted data - the Verifier is
attempting to verify the current trust status of the node after all - it
needs to be assumed that malicous data can also be supplied here.

Therefore the question arises whether \`zlib.decompress()\` is robust
against processing invalid ZIP data streams. One thing I already found
out is that it is not robust against delivering ZIP bombs that will
cause a memory exhaustion in the Verifier process.

This finding also is valid similarly for all other Keylime interface
that process ZIP data, like in the Agent.

### Upstream Advisory

https://github.com/keylime/keylime/security/advisories/GHSA-6xx7-m45w-76m2

### Upstream Fixes

This fix simply removes the ZIP compression from the Verifier interface:

https://github.com/keylime/keylime/commit/6e44758b64b0ee13564fc46e807f4ba98091c355

5) General Findings
===================

This section contains findings that apply to all keylime components
alike.

a) World-Readable keylime.conf Contains Potentially Sensitive Data (CVE-2022-23952)
-----------------------------------------------------------------------------------

The configuration \`/etc/keylime.conf\` is installed world-readable:

    $ ls -l /etc/keylime.conf
    -rw-r--r-- 1 root root 26770 Dec 16 14:54 /etc/keylime.conf

This is the case for installations performed manually via the provided
\`installer.sh\` script as well as for the RPM packaging found in both
openSUSE Tumbleweed and Fedora 35 Linux distributions. Further
distributions might be affected.

\`keylime.conf\` contains a lot of information, some of it sensitive like
the TPM ownership password (\`tpm\_ownerpassword\`), TLS certificate
private key passwords (\`private\_key\_pw\`, \`registrar\_private\_key\_pw\`) or
the database password for the Registrar (\`database\_password\`). Thus this
is a local information leak, because arbitrary local users can obtain
these passwords from the configuration file.

My recommendation is to make this file only accessible to \_root\_ and
adjust all installation routines and possibly documentation. The Keylime
code could perform a sanity check of the permissions of the
configuration file before reading it in.

### Upstream Advisory

https://github.com/keylime/keylime/security/advisories/GHSA-fchm-5w2v-qfm8

### Upstream Fixes

The following fix explicitly sets the permissions for the configuration
file in the installer:

https://github.com/keylime/keylime/commit/883085d6a4bcea3012729014d5b8e15ecd65fc7c

b) Lack of Privilege Separation
-------------------------------

All keylime services are currently designed to run as root all the time
(except for testing purposes, see \`REQUIRE\_ROOT\` in \`config.py\`). Only
few bits of the keylime components actually should need root privileges.
Most notably the bootstrapping scripts in the Agent component or the
ability to bind privileged ports.

Implementing a privilege separation approach would increase the defense
in depth for keylime considerably, avoiding smaller security issues to
become severe fast.

### Upstream Statement

Keylime upstream states that it is already possible to run Keylime as
non-root. The \`REQUIRE\_ROOT\` bits are not strictly necessary any more
and can be removed from the code. The Debian packaging already makes use
of the privilege separation.

6) Timeline
===========

2021-12-09: I started the review on the code
2021-12-23: I contacted the upstream security contact and upstream
            developer Thore Sommer privately by email and provided them
            the report results, offering coordinates disclosure.
2022-01-04: Upstream confirmed most of my findings and work on the fixes
            began. Alberto Planas, a SUSE colleague and maintainer of
            the SUSE Keylime packaging also contributed some fixes.
2022-01-28: Publication of the security advisories and fixes by upstream
            took place. Upstream also discovered some further security
            issues themselves in the meanwhile.

\[1\]: https://github.com/keylime/keylime
\[2\]: https://www.openwall.com/lists/oss-security/2020/06/04/5
\[3\]: https://www.ll.mit.edu/sites/default/files/publication/doc/2018-04/2016\_12\_07\_SchearN\_ACSAC\_FP.pdf

Cheers

Matthias

-- 
Matthias Gerstner <matthias.gerstner () suse de>
Security Engineer
https://www.suse.com/security
GPG Key ID: 0x14C405C971923553
 
SUSE Software Solutions Germany GmbH
HRB 36809, AG Nürnberg
Geschäftsführer: Ivo Totev

**Attachment: post\_agent.py**  
_Description:_

**Attachment: post\_key.py**  
_Description:_

**Attachment: signature.asc**  
_Description:_

**Current thread:**

*   **keylime: Multiple Security Issues (including remote code execution in the Agent component)** _Matthias Gerstner (Jan 28)_

CVE-2022-23952: Multiple Security Issues (including remote code execution in the Agent component)

Data scientists, who often choose open source packages without considering security, increasingly face concerns over the unvetted use of those components, new study shows.

Vulnerabilities in open source components — such as the widespread flaws revealed 10 months ago in Log4j 2.0 — have forced data scientists to reevaluate the open source code frequently used in analysis and the creation of machine learning models.

According to a report by Anaconda, a data-science platform firm, in the past year, 40% of surveyed data scientists, business analysts, and students have scaled back their use of open source components, while a third remained steady, and only 7% incorporated more open source code into their projects. The majority of those surveyed do not report to the information technology department (18%), but work within their own data science or research and development group (47%), according to Anaconda's "2022 State of Data Science" report, released last week.

While software developers and IT have already started vetting secure code, the concerns over the security in open source software is a relatively new trend for the data science world, says Peter Wang, co-founder and CEO of Anaconda.

"We see a tremendous portion of people who are at organizations where IT has created a very strict posture around open source and Python," he says. "These are not expert developers. ... They are data scientists and machine learning people who may not be very seasoned developers at all, using whatever they could download to do their analysis, and then they handed that over that to IT."

The security of open source components — and the software supply chain, in general — has become a primary consideration among software developers, businesses, and national governments over the past two years. In May, for example, the US National Institute of Standards and Technology (NIST) issued guidance for address software supply chain risks. In addition, a growing number of software vendors have joined with the Linux Foundation's Open Software Security Foundation (OpenSSF).

    

While many data science teams scan open source components for vulnerabilities, many create their own software instead. Source: Anaconda's "2022 State of Data Science" report.

Overall, the maturity of organizations' security efforts has improved. About half of firms have an open source security policy in place, which leads to better performance in measures of security readiness, according to the June survey. In addition, the efforts to control open source risk has jumped by 51% in the past 12 months, a study of security maturity stated on Sept. 21.

"\[W\]ith the attention placed on software supply chains, most enterprise organizations are taking a risk-based approach to application security," Jason Schmitt, general manager of the Synopsys Software Integrity Group, said in a statement announcing the study. "Such an approach recognizes that security isn't limited to the codebase; it includes the process of software development where security reviews and testing 'shift everywhere' to continuously improve security outcomes."

**Devs Expand Use of Open Source **

Software companies are not seeing any sort of decrease in open source usage, according to other data. Instead, development organizations are focusing on improving the security of open source software and using security as a primary guide in selecting components.

In the "2021 State of the Software Supply Chain" report, for example, Sonatype found that the top four open source ecosystems — the Maven Central Repository (Java), Node.js (JavaScript), the Python Package Index (Python), and the NuGet gallery (.NET) — housed 37 million open source projects and components, an increase of 20% year-over-year. The demand for those components is likewise increasing: More than 2.2 trillion components were downloaded, a 73% annual increase.

A self-reported move away from open source packages by the data science community is likely indicative of greater awareness of security issues and less about jettisoning open source components in development, says Tracy Miranda, head of open source at Chainguard.

While data science teams and development teams may have reacted differently to major security issues — such as Log4j 2.0 — companies have little recourse when moving away from one open source package than to adopt a different package whose maintainers have put a greater emphasis on security, she says.

"Companies leverage open source as a way to increase their velocity so if they are scaling back, what are they scaling back to? Writing code in-house? Using third-party versions packaged up?" Miranda says, adding that instead, "I do think we can expect to see companies be more discerning about the quality of the open source they use, especially related to security features."

**Data Scientists Are Playing Catch-up**

The disconnect between the two sides is likely due to the different audiences in the various surveys. Anaconda's survey focused on data science professionals, as can be seen from their respondent's choice of programming languages — 58% used Python and 42% used SQL, while only 26% used JavaScript. 

A better measure of software developer sentiments is StackOverflow's "2022 Developer Survey," which found that while 58% of 'people learning to code' use Python, only 44% of professional developers code in that language. On the other hand, 68% of professional developers use JavaScript, according to StackOverflow's survey.

In addition, while data science professional work at companies that overwhelmingly (87%) allow open-source software, about a quarter (26%) have minimal oversight by the IT department of their open source choices, the Anaconda report stated. In another 18% of companies, the IT department only specifies about half of the available open source components.

The maintainers of the most critical projects — of which there are hundreds, if not thousands — need to use secure dependencies, test their own code, and validate the trustworthiness of contributors. The maintainers should also publish a security scorecard — a Google-created initiative now managed by the Open Source Security Foundation (OpenSSF), which gives a security grade to a project based on nearly 20 different criteria.

While awareness is likely increasing, there is no quick solution, Miranda says.

"The reality is that the more secure options have not previously existed," she says. "Trimming unnecessary dependencies to reduce attack surface is sensible, but it's hard to do once the dependency tree has grown large."

Data Scientists Dial Back Use of Open Source Code Due to Security Worries

Jenkins WildFly Deployer Plugin 1.0.2 and earlier implements functionality that allows agent processes to read arbitrary files on the Jenkins controller file system.

This advisory announces vulnerabilities in the following Jenkins deliverables:

*   Jenkins (core)
*   Anchore Container Image Scanner Plugin
*   Apprenda Plugin
*   BigPanda Notifier Plugin
*   BMC AMI Common Configuration Plugin
*   build-publisher Plugin
*   CONS3RT Plugin
*   DotCi Plugin
*   extreme-feedback Plugin
*   NS-ND Integration Performance Publisher Plugin
*   NS-ND Integration Performance Publisher Plugin
*   RQM Plugin
*   Rundeck Plugin
*   SCM HttpClient Plugin
*   Security Inspector Plugin
*   SmallTest Plugin
*   View26 Test-Reporting Plugin
*   Walti Plugin
*   WildFly Deployer Plugin
*   Worksoft Execution Manager Plugin

**Descriptions****XSS vulnerability**

**SECURITY-2886 / CVE-2022-41224**  
**Severity (CVSS):** High  
**Description:**

Jenkins 2.367 through 2.369 (both inclusive) does not escape tooltips of the l:helpIcon UI component used for some help icons on the Jenkins web UI.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control tooltips for this component.

As of publication, the Jenkins security team is unaware of any exploitable help icon/tooltip in Jenkins core or plugins published by the Jenkins project. The vast majority of help icons use the l:help component instead of l:helpIcon. The few known instances of l:helpIcon do not have user-controllable tooltip contents.

Jenkins 2.370 escapes tooltips of the l:helpIcon UI component.

**Stored XSS vulnerability in Anchore Container Image Scanner Plugin**

**SECURITY-2821 / CVE-2022-41225**  
**Severity (CVSS):** High  
**Affected plugin: anchore-container-scanner**  
**Description:**

Anchore Container Image Scanner Plugin 1.0.24 and earlier does not escape content provided by the Anchore engine API.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control API responses by Anchore engine.

Anchore Container Image Scanner Plugin 1.0.25 escapes content provided by the Anchore engine API.

**XXE vulnerability in BMC AMI Common Configuration Plugin**

**SECURITY-2832 / CVE-2022-41226**  
**Severity (CVSS):** High  
**Affected plugin: compuware-common-configuration**  
**Description:**

BMC AMI Common Configuration Plugin 1.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers able to change the contents of the Topaz Workbench CLI home directory on agents to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

BMC AMI Common Configuration Plugin 1.0.15 disables external entity resolution for its XML parser.

**CSRF vulnerability and missing permission check in NS-ND Integration Performance Publisher Plugin**

**SECURITY-2737 / CVE-2022-41227 (CSRF), CVE-2022-41228 (missing permission check)**  
**Severity (CVSS):** Medium  
**Affected plugin: cavisson-ns-nd-integration**  
**Description:**

NS-ND Integration Performance Publisher Plugin 4.8.0.129 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified username and password.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

NS-ND Integration Performance Publisher Plugin 4.8.0.130 requires POST requests and Overall/Administer permission for the affected form validation method.

**Stored XSS vulnerability in NS-ND Integration Performance Publisher Plugin**

**SECURITY-2858 / CVE-2022-41229**  
**Severity (CVSS):** High  
**Affected plugin: cavisson-ns-nd-integration**  
**Description:**

NS-ND Integration Performance Publisher Plugin 4.8.0.134 and earlier does not escape configuration options of the Execute NetStorm/NetCloud Test build step.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

**Missing permission check in build-publisher Plugin**

**SECURITY-1994 / CVE-2022-41230**  
**Severity (CVSS):** Medium  
**Affected plugin: build-publisher**  
**Description:**

build-publisher Plugin 1.22 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to obtain names and URLs of Jenkins servers that the plugin is configured to publish builds to, as well as builds pending for publication to those Jenkins servers.

**Path traversal and CSRF vulnerability in build-publisher Plugin**

**SECURITY-2139 / CVE-2022-41231 (path traversal), CVE-2022-41232 (CSRF)**  
**Severity (CVSS):** High  
**Affected plugin: build-publisher**  
**Description:**

build-publisher Plugin 1.22 and earlier allows attackers with Item/Configure permission to create or replace any config.xml file on the Jenkins controller file system by providing a crafted file name to an API endpoint.

Additionally, this endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability that allows attackers to replace any config.xml file on the Jenkins controller file system with an empty file.

**Missing permission checks in Rundeck Plugin**

**SECURITY-2170 / CVE-2022-41233**  
**Severity (CVSS):** Medium  
**Affected plugin: rundeck**  
**Description:**

Rundeck Plugin 3.6.11 and earlier does not perform Run/Artifacts permission checks in multiple HTTP endpoints.

This allows attackers with Item/Read permission to obtain information about build artifacts of a given job, if the optional Run/Artifacts permission is enabled.

**Missing webhook endpoint authorization in Rundeck Plugin**

**SECURITY-2169 / CVE-2022-41234**  
**Severity (CVSS):** Medium  
**Affected plugin: rundeck**  
**Description:**

Rundeck Plugin 3.6.11 and earlier does not protect access to the /plugin/rundeck/webhook/ endpoint.

This allows attackers with Item/Read permission to trigger jobs that are configured to be triggerable via Rundeck.

**Agent-to-controller security bypass in WildFly Deployer Plugin allows reading arbitrary files**

**SECURITY-2645 / CVE-2022-41235**  
**Severity (CVSS):** Medium  
**Affected plugin: wildfly-deployer**  
**Description:**

WildFly Deployer Plugin 1.0.2 and earlier implements functionality that allows agent processes to read arbitrary files on the Jenkins controller file system.

This allows attackers able to control agent processes to read arbitrary files on the Jenkins controller file system.

This vulnerability is only exploitable in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. See the LTS upgrade guide.

**CSRF vulnerability in Security Inspector Plugin**

**SECURITY-2051 / CVE-2022-41236**  
**Severity (CVSS):** Medium  
**Affected plugin: security-inspector**  
**Description:**

Security Inspector Plugin 117.v6eecc36919c2 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to replace the generated report stored in a per-session cache and displayed to authorized users at the …​/report URL with a report based on attacker-specified report generation options. This could create confusion in users of the plugin who are expecting to see a different result.

A security hardening since Jenkins 2.287 and LTS 2.277.2 prevents exploitation of this vulnerability for the _Single user, multiple jobs_ report. Other report types are still affected.

**RCE vulnerability in DotCi Plugin**

**SECURITY-1737 / CVE-2022-41237**  
**Severity (CVSS):** High  
**Affected plugin: DotCi**  
**Description:**

DotCi Plugin 2.40.00 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types.

This results in a remote code execution (RCE) vulnerability exploitable by attackers able to modify .ci.yml files in SCM.

**Lack of authentication mechanism in DotCi Plugin webhook**

**SECURITY-2867 / CVE-2022-41238**  
**Severity (CVSS):** Medium  
**Affected plugin: DotCi**  
**Description:**

DotCi Plugin provides a webhook endpoint at /githook/ that can be used to trigger builds of the job for a GitHub repository.

In DotCi Plugin 2.40.00 and earlier, this endpoint can be accessed without authentication.

This allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository for attacker-specified commits.

**Stored XSS vulnerability in DotCi Plugin**

**SECURITY-2884 / CVE-2022-41239**  
**Severity (CVSS):** High  
**Affected plugin: DotCi**  
**Description:**

DotCi Plugin 2.40.00 and earlier does not escape the GitHub user name parameter provided to commit notifications when displaying them in a build cause.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to submit crafted commit notifications to the /githook/ endpoint (see also SECURITY-2867).

This vulnerability is only exploitable in Jenkins 2.314 and earlier, LTS 2.303.1 and earlier. See the LTS upgrade guide.

**Stored XSS vulnerability in Walti Plugin**

**SECURITY-1870 / CVE-2022-41240**  
**Severity (CVSS):** High  
**Affected plugin: walti**  
**Description:**

Walti Plugin 1.0.1 and earlier does not escape the information provided by the Walti API.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide malicious API responses from Walti.

**XXE vulnerability in RQM Plugin**

**SECURITY-2805 / CVE-2022-41241**  
**Severity (CVSS):** Medium  
**Affected plugin: rqm-plugin**  
**Description:**

RQM Plugin 2.8 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers able to provide crafted API responses from Rational Quality Manager to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

**Missing permission check in extreme-feedback Plugin**

**SECURITY-2001 / CVE-2022-41242**  
**Severity (CVSS):** Medium  
**Affected plugin: extreme-feedback**  
**Description:**

extreme-feedback Plugin 1.7 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to discover information about job names attached to lamps, discover MAC and IP addresses of existing lamps, and rename lamps.

**Missing hostname validation in SmallTest Plugin**

**SECURITY-2068 / CVE-2022-41243**  
**Severity (CVSS):** Medium  
**Affected plugin: smalltest**  
**Description:**

SmallTest Plugin 1.0.4 and earlier does not perform hostname validation when connecting to the configured SmallTest server.

This lack of validation could be abused using a man-in-the-middle attack to intercept these connections.

**Missing hostname validation in View26 Test-Reporting Plugin**

**SECURITY-2069 / CVE-2022-41244**  
**Severity (CVSS):** Medium  
**Affected plugin: view26**  
**Description:**

View26 Test-Reporting Plugin 1.0.7 and earlier does not perform hostname validation when connecting to the configured View26 server.

This lack of validation could be abused using a man-in-the-middle attack to intercept these connections.

**CSRF vulnerability and missing permission check in Worksoft Execution Manager Plugin allow capturing credentials**

**SECURITY-2237 / CVE-2022-41245 (CSRF), CVE-2022-41246 (missing permission check)**  
**Severity (CVSS):** Medium  
**Affected plugin: ws-execution-manager**  
**Description:**

Worksoft Execution Manager Plugin 10.0.3.503 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

**API key stored in plain text by BigPanda Notifier Plugin**

**SECURITY-2243 / CVE-2022-41247 (storage), CVE-2022-41248 (masking)**  
**Severity (CVSS):** Low  
**Affected plugin: bigpanda-jenkins**  
**Description:**

BigPanda Notifier Plugin 1.4.0 and earlier stores the BigPanda API key unencrypted in its global configuration file BigpandaGlobalNotifier.xml on the Jenkins controller as part of its configuration.

This API key can be viewed by users with access to the Jenkins controller file system.

Additionally, the global configuration form does not mask the API key, increasing the potential for attackers to observe and capture it.

**CSRF vulnerability and missing permission check in SCM HttpClient Plugin allow capturing credentials**

**SECURITY-2708 / CVE-2022-41249 (CSRF), CVE-2022-41250 (missing permission check)**  
**Severity (CVSS):** Medium  
**Affected plugin: scm-httpclient**  
**Description:**

SCM HttpClient Plugin 1.5 and earlier does not perform permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

**Missing permission check in Apprenda Plugin allows enumerating credentials IDs**

**SECURITY-2710 / CVE-2022-41251**  
**Severity (CVSS):** Medium  
**Affected plugin: apprenda**  
**Description:**

Apprenda Plugin 2.2.0 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

**Missing permission checks in CONS3RT Plugin allow enumerating credentials IDs**

**SECURITY-2752 / CVE-2022-41252**  
**Severity (CVSS):** Medium  
**Affected plugin: cons3rt**  
**Description:**

CONS3RT Plugin 1.0.0 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

**CSRF vulnerability and missing permission checks in CONS3RT Plugin allow capturing credentials**

**SECURITY-2751 / CVE-2022-41253 (CSRF), CVE-2022-41254 (missing permission check)**  
**Severity (CVSS):** Medium  
**Affected plugin: cons3rt**  
**Description:**

CONS3RT Plugin 1.0.0 and earlier does not perform permission checks in methods implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, these form validation methods do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

**API token stored in plain text by CONS3RT Plugin**

**SECURITY-2759 / CVE-2022-41255**  
**Severity (CVSS):** Low  
**Affected plugin: cons3rt**  
**Description:**

CONS3RT Plugin 1.0.0 and earlier stores Cons3rt API token unencrypted in job config.xml files on the Jenkins controller as part of its configuration.

This API token can be viewed by users with access to the Jenkins controller file system.

**Severity**

*   SECURITY-1737: High
*   SECURITY-1870: High
*   SECURITY-1994: Medium
*   SECURITY-2001: Medium
*   SECURITY-2051: Medium
*   SECURITY-2068: Medium
*   SECURITY-2069: Medium
*   SECURITY-2139: High
*   SECURITY-2169: Medium
*   SECURITY-2170: Medium
*   SECURITY-2237: Medium
*   SECURITY-2243: Low
*   SECURITY-2645: Medium
*   SECURITY-2708: Medium
*   SECURITY-2710: Medium
*   SECURITY-2737: Medium
*   SECURITY-2751: Medium
*   SECURITY-2752: Medium
*   SECURITY-2759: Low
*   SECURITY-2805: Medium
*   SECURITY-2821: High
*   SECURITY-2832: High
*   SECURITY-2858: High
*   SECURITY-2867: Medium
*   SECURITY-2884: High
*   SECURITY-2886: High

**Affected Versions**

*   **Jenkins weekly** up to and including 2.369
*   **Anchore Container Image Scanner Plugin** up to and including 1.0.24
*   **Apprenda Plugin** up to and including 2.2.0
*   **BigPanda Notifier Plugin** up to and including 1.4.0
*   **BMC AMI Common Configuration Plugin** up to and including 1.0.14
*   **build-publisher Plugin** up to and including 1.22
*   **CONS3RT Plugin** up to and including 1.0.0
*   **DotCi Plugin** up to and including 2.40.00
*   **extreme-feedback Plugin** up to and including 1.7
*   **NS-ND Integration Performance Publisher Plugin** up to and including 4.8.0.129
*   **NS-ND Integration Performance Publisher Plugin** up to and including 4.8.0.134
*   **RQM Plugin** up to and including 2.8
*   **Rundeck Plugin** up to and including 3.6.11
*   **SCM HttpClient Plugin** up to and including 1.5
*   **Security Inspector Plugin** up to and including 117.v6eecc36919c2
*   **SmallTest Plugin** up to and including 1.0.4
*   **View26 Test-Reporting Plugin** up to and including 1.0.7
*   **Walti Plugin** up to and including 1.0.1
*   **WildFly Deployer Plugin** up to and including 1.0.2
*   **Worksoft Execution Manager Plugin** up to and including 10.0.3.503

**Fix**

*   **Jenkins weekly** should be updated to version 2.370
*   **Anchore Container Image Scanner Plugin** should be updated to version 1.0.25
*   **BMC AMI Common Configuration Plugin** should be updated to version 1.0.15
*   **NS-ND Integration Performance Publisher Plugin** should be updated to version 4.8.0.130

These versions include fixes to the vulnerabilities described above. All prior versions are considered to be affected by these vulnerabilities unless otherwise indicated.

As of publication of this advisory, no fixes are available for the following plugins:

*   Apprenda Plugin
*   BigPanda Notifier Plugin
*   build-publisher Plugin
*   CONS3RT Plugin
*   DotCi Plugin
*   extreme-feedback Plugin
*   NS-ND Integration Performance Publisher Plugin
*   RQM Plugin
*   Rundeck Plugin
*   SCM HttpClient Plugin
*   Security Inspector Plugin
*   SmallTest Plugin
*   View26 Test-Reporting Plugin
*   Walti Plugin
*   WildFly Deployer Plugin
*   Worksoft Execution Manager Plugin

Learn why we announce these issues.

**Credit**

The Jenkins project would like to thank the reporters for discovering and reporting these vulnerabilities:

*   **Daniel Beck, CloudBees, Inc.** for SECURITY-2169, SECURITY-2170, SECURITY-2645, SECURITY-2821, SECURITY-2884
*   **Jeff Thompson, CloudBees, Inc.** for SECURITY-2051
*   **Jesse Glick, CloudBees, Inc.** for SECURITY-2886
*   **Kevin Guerroudj, CloudBees, Inc.** for SECURITY-2237, SECURITY-2737, SECURITY-2805, SECURITY-2858, SECURITY-2867
*   **Long Nguyen, Viettel Cyber Security** for SECURITY-2068, SECURITY-2069
*   **Marc Heyries** for SECURITY-2243
*   **Matt Sicker, CloudBees, Inc.** for SECURITY-1994, SECURITY-2001
*   **Valdes Che Zogou, CloudBees, Inc.** for SECURITY-2708, SECURITY-2710, SECURITY-2751, SECURITY-2752, SECURITY-2832
*   **Valdes Che Zogou, CloudBees, Inc. and Kevin Guerroudj, CloudBees, Inc.** for SECURITY-2759
*   **Wadeck Follonier, CloudBees, Inc.** for SECURITY-1870, SECURITY-2139

CVE-2022-41235: Jenkins Security Advisory 2022-09-21

Jenkins Compuware Common Configuration Plugin 1.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This advisory announces vulnerabilities in the following Jenkins deliverables:

*   Jenkins (core)
*   Anchore Container Image Scanner Plugin
*   Apprenda Plugin
*   BigPanda Notifier Plugin
*   Build-Publisher Plugin
*   Compuware Common Configuration Plugin
*   CONS3RT Plugin
*   DotCi Plugin
*   extreme-feedback Plugin
*   NS-ND Integration Performance Publisher Plugin
*   NS-ND Integration Performance Publisher Plugin
*   RQM Plugin
*   Rundeck Plugin
*   SCM HttpClient Plugin
*   Security Inspector Plugin
*   SmallTest Plugin
*   View26 Test-Reporting Plugin
*   Walti Plugin
*   WildFly Deployer Plugin
*   Worksoft Execution Manager Plugin

**Descriptions****XSS vulnerability**

**SECURITY-2886 / CVE-2022-41224**  
**Severity (CVSS):** High  
**Description:**

Jenkins 2.367 through 2.369 (both inclusive) does not escape tooltips of the l:helpIcon UI component used for some help icons on the Jenkins web UI.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control tooltips for this component.

As of publication, the Jenkins security team is unaware of any exploitable help icon/tooltip in Jenkins core or plugins published by the Jenkins project. The vast majority of help icons use the l:help component instead of l:helpIcon. The few known instances of l:helpIcon do not have user-controllable contents.

Jenkins 2.370 escapes tooltips of the l:helpIcon UI component.

**Stored XSS vulnerability in Anchore Container Image Scanner Plugin**

**SECURITY-2821 / CVE-2022-41225**  
**Severity (CVSS):** High  
**Affected plugin: anchore-container-scanner**  
**Description:**

Anchore Container Image Scanner Plugin 1.0.24 and earlier does not escape content provided by the Anchore engine API.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control API responses by Anchore engine.

Anchore Container Image Scanner Plugin 1.0.25 escapes content provided by the Anchore engine API.

**XXE vulnerability in Compuware Common Configuration Plugin**

**SECURITY-2832 / CVE-2022-41226**  
**Severity (CVSS):** High  
**Affected plugin: compuware-common-configuration**  
**Description:**

Compuware Common Configuration Plugin 1.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers able to change the contents of the Topaz Workbench CLI home directory on agents to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

Compuware Common Configuration Plugin 1.0.15 disables external entity resolution for its XML parser.

**CSRF vulnerability and missing permission check in NS-ND Integration Performance Publisher Plugin**

**SECURITY-2737 / CVE-2022-41227 (CSRF), CVE-2022-41228 (missing permission check)**  
**Severity (CVSS):** Medium  
**Affected plugin: cavisson-ns-nd-integration**  
**Description:**

NS-ND Integration Performance Publisher Plugin 4.8.0.129 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified username and password.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

NS-ND Integration Performance Publisher Plugin 4.8.0.130 requires POST requests and Overall/Administer permission for the affected form validation method.

**Stored XSS vulnerability in NS-ND Integration Performance Publisher Plugin**

**SECURITY-2858 / CVE-2022-41229**  
**Severity (CVSS):** High  
**Affected plugin: cavisson-ns-nd-integration**  
**Description:**

NS-ND Integration Performance Publisher Plugin 4.8.0.134 and earlier does not escape configuration options of the Execute NetStorm/NetCloud Test build step.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

**Missing permission check in Build-Publisher Plugin**

**SECURITY-1994 / CVE-2022-41230**  
**Severity (CVSS):** Medium  
**Affected plugin: build-publisher**  
**Description:**

Build-Publisher Plugin 1.22 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to obtain names and URLs of Jenkins servers that the plugin is configured to publish builds to, as well as builds pending for publication to those Jenkins servers.

**Path traversal and CSRF vulnerability in Build-Publisher Plugin**

**SECURITY-2139 / CVE-2022-41231 (path traversal), CVE-2022-41232 (CSRF)**  
**Severity (CVSS):** High  
**Affected plugin: build-publisher**  
**Description:**

Build-Publisher Plugin 1.22 and earlier allows attackers with Item/Configure permission to create or replace any config.xml file on the Jenkins controller file system by providing a crafted file name to an API endpoint.

Additionally, this endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability that allows attackers to replace any config.xml file on the Jenkins controller file system with an empty file.

**Missing permission checks in Rundeck Plugin**

**SECURITY-2170 / CVE-2022-41233**  
**Severity (CVSS):** Medium  
**Affected plugin: rundeck**  
**Description:**

Rundeck Plugin 3.6.11 and earlier does not perform Run/Artifacts permission checks in multiple HTTP endpoints.

This allows attackers with Item/Read permission to obtain information about build artifacts of a given job, if the optional Run/Artifacts permission is enabled.

**Missing webhook endpoint authorization in Rundeck Plugin**

**SECURITY-2169 / CVE-2022-41234**  
**Severity (CVSS):** Medium  
**Affected plugin: rundeck**  
**Description:**

Rundeck Plugin 3.6.11 and earlier does not protect access to the /plugin/rundeck/webhook/ endpoint.

This allows attackers with Item/Read permission to trigger jobs that are configured to be triggerable via Rundeck.

**Path traversal vulnerability in WildFly Deployer Plugin allows reading arbitrary files**

**SECURITY-2645 / CVE-2022-41235**  
**Severity (CVSS):** Medium  
**Affected plugin: wildfly-deployer**  
**Description:**

WildFly Deployer Plugin 1.0.2 and earlier implements functionality that allows agent processes to read arbitrary files on the Jenkins controller file system.

This allows attackers able to control agent processes to read arbitrary files on the Jenkins controller file system.

This vulnerability is only exploitable in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. See the LTS upgrade guide.

**CSRF vulnerability in Security Inspector Plugin**

**SECURITY-2051 / CVE-2022-41236**  
**Severity (CVSS):** Medium  
**Affected plugin: security-inspector**  
**Description:**

Security Inspector Plugin 117.v6eecc36919c2 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to replace the generated report stored in a per-session cache and displayed to authorized users at the …​/report URL with a report based on attacker-specified report generation options. This could create confusion in users of the plugin who are expecting to see a different result.

A security hardening since Jenkins 2.287 and LTS 2.277.2 prevents exploitation of this vulnerability for the _Single user, multiple jobs_ report. Other report types are still affected.

**RCE vulnerability in DotCi Plugin**

**SECURITY-1737 / CVE-2022-41237**  
**Severity (CVSS):** High  
**Affected plugin: DotCi**  
**Description:**

DotCi Plugin 2.40.00 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types.

This results in a remote code execution (RCE) vulnerability exploitable by attackers able to modify .ci.yml files in SCM.

**Lack of authentication mechanism in DotCi Plugin webhook**

**SECURITY-2867 / CVE-2022-41238**  
**Severity (CVSS):** Medium  
**Affected plugin: DotCi**  
**Description:**

DotCi Plugin provides a webhook endpoint at /githook/ that can be used to trigger builds of the job for a GitHub repository.

In DotCi Plugin 2.40.00 and earlier, this endpoint can be accessed without authentication.

This allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository for attacker-specified commits.

**Stored XSS vulnerability in DotCi Plugin**

**SECURITY-2884 / CVE-2022-41239**  
**Severity (CVSS):** High  
**Affected plugin: DotCi**  
**Description:**

DotCi Plugin 2.40.00 and earlier does not escape the GitHub user name parameter provided to commit notifications when displaying them in a build cause.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to submit crafted commit notifications to the /githook/ endpoint (see also SECURITY-2867).

This vulnerability is only exploitable in Jenkins 2.314 and earlier, LTS 2.303.1 and earlier. See the LTS upgrade guide.

**Stored XSS vulnerability in Walti Plugin**

**SECURITY-1870 / CVE-2022-41240**  
**Severity (CVSS):** High  
**Affected plugin: walti**  
**Description:**

Walti Plugin 1.0.1 and earlier does not escape the information provided by the Walti API.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide malicious API responses from Walti.

**XXE vulnerability in RQM Plugin**

**SECURITY-2805 / CVE-2022-41241**  
**Severity (CVSS):** Medium  
**Affected plugin: rqm-plugin**  
**Description:**

RQM Plugin 2.8 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers able to provide crafted API responses from Rational Quality Manager to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

**Missing permission check in extreme-feedback Plugin**

**SECURITY-2001 / CVE-2022-41242**  
**Severity (CVSS):** Medium  
**Affected plugin: extreme-feedback**  
**Description:**

extreme-feedback Plugin 1.7 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to discover information about job names attached to lamps, discover MAC and IP addresses of existing lamps, and rename lamps.

**Missing hostname validation in SmallTest Plugin**

**SECURITY-2068 / CVE-2022-41243**  
**Severity (CVSS):** Medium  
**Affected plugin: smalltest**  
**Description:**

SmallTest Plugin 1.0.4 and earlier does not perform hostname validation when connecting to the configured SmallTest server.

This lack of validation could be abused using a man-in-the-middle attack to intercept these connections.

**Missing hostname validation in View26 Test-Reporting Plugin**

**SECURITY-2069 / CVE-2022-41244**  
**Severity (CVSS):** Medium  
**Affected plugin: view26**  
**Description:**

View26 Test-Reporting Plugin 1.0.7 and earlier does not perform hostname validation when connecting to the configured View26 server.

This lack of validation could be abused using a man-in-the-middle attack to intercept these connections.

**CSRF vulnerability and missing permission check in Worksoft Execution Manager Plugin allow capturing credentials**

**SECURITY-2237 / CVE-2022-41245 (CSRF), CVE-2022-41246 (missing permission check)**  
**Severity (CVSS):** Medium  
**Affected plugin: ws-execution-manager**  
**Description:**

Worksoft Execution Manager Plugin 10.0.3.503 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

**API key stored in plain text by BigPanda Notifier Plugin**

**SECURITY-2243 / CVE-2022-41247 (storage), CVE-2022-41248 (masking)**  
**Severity (CVSS):** Low  
**Affected plugin: bigpanda-jenkins**  
**Description:**

BigPanda Notifier Plugin 1.4.0 and earlier stores the BigPanda API key unencrypted in its global configuration file BigpandaGlobalNotifier.xml on the Jenkins controller as part of its configuration.

This API key can be viewed by users with access to the Jenkins controller file system.

Additionally, the global configuration form does not mask the API key, increasing the potential for attackers to observe and capture it.

**CSRF vulnerability and missing permission check in SCM HttpClient Plugin allow capturing credentials**

**SECURITY-2708 / CVE-2022-41249 (CSRF), CVE-2022-41250 (missing permission check)**  
**Severity (CVSS):** Medium  
**Affected plugin: scm-httpclient**  
**Description:**

SCM HttpClient Plugin 1.5 and earlier does not perform permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

**Missing permission check in Apprenda Plugin allows enumerating credentials IDs**

**SECURITY-2710 / CVE-2022-41251**  
**Severity (CVSS):** Medium  
**Affected plugin: apprenda**  
**Description:**

Apprenda Plugin 2.2.0 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

**Missing permission checks in CONS3RT Plugin allow enumerating credentials IDs**

**SECURITY-2752 / CVE-2022-41252**  
**Severity (CVSS):** Medium  
**Affected plugin: cons3rt**  
**Description:**

CONS3RT Plugin 1.0.0 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

**CSRF vulnerability and missing permission checks in CONS3RT Plugin allow capturing credentials**

**SECURITY-2751 / CVE-2022-41253 (CSRF), CVE-2022-41254 (missing permission check)**  
**Severity (CVSS):** Medium  
**Affected plugin: cons3rt**  
**Description:**

CONS3RT Plugin 1.0.0 and earlier does not perform permission checks in methods implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, these form validation methods do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

**API token stored in plain text by CONS3RT Plugin**

**SECURITY-2759 / CVE-2022-41255**  
**Severity (CVSS):** Low  
**Affected plugin: cons3rt**  
**Description:**

CONS3RT Plugin 1.0.0 and earlier stores Cons3rt API token unencrypted in job config.xml files on the Jenkins controller as part of its configuration.

This API token can be viewed by users with access to the Jenkins controller file system.

**Severity**

*   SECURITY-1737: High
*   SECURITY-1870: High
*   SECURITY-1994: Medium
*   SECURITY-2001: Medium
*   SECURITY-2051: Medium
*   SECURITY-2068: Medium
*   SECURITY-2069: Medium
*   SECURITY-2139: High
*   SECURITY-2169: Medium
*   SECURITY-2170: Medium
*   SECURITY-2237: Medium
*   SECURITY-2243: Low
*   SECURITY-2645: Medium
*   SECURITY-2708: Medium
*   SECURITY-2710: Medium
*   SECURITY-2737: Medium
*   SECURITY-2751: Medium
*   SECURITY-2752: Medium
*   SECURITY-2759: Low
*   SECURITY-2805: Medium
*   SECURITY-2821: High
*   SECURITY-2832: High
*   SECURITY-2858: High
*   SECURITY-2867: Medium
*   SECURITY-2884: High
*   SECURITY-2886: High

**Affected Versions**

*   Jenkins weekly up to and including 2.369
*   **Anchore Container Image Scanner Plugin** up to and including 1.0.24
*   **Apprenda Plugin** up to and including 2.2.0
*   **BigPanda Notifier Plugin** up to and including 1.4.0
*   **Build-Publisher Plugin** up to and including 1.22
*   **Compuware Common Configuration Plugin** up to and including 1.0.14
*   **CONS3RT Plugin** up to and including 1.0.0
*   **DotCi Plugin** up to and including 2.40.00
*   **extreme-feedback Plugin** up to and including 1.7
*   **NS-ND Integration Performance Publisher Plugin** up to and including 4.8.0.129
*   **NS-ND Integration Performance Publisher Plugin** up to and including 4.8.0.134
*   **RQM Plugin** up to and including 2.8
*   **Rundeck Plugin** up to and including 3.6.11
*   **SCM HttpClient Plugin** up to and including 1.5
*   **Security Inspector Plugin** up to and including 117.v6eecc36919c2
*   **SmallTest Plugin** up to and including 1.0.4
*   **View26 Test-Reporting Plugin** up to and including 1.0.7
*   **Walti Plugin** up to and including 1.0.1
*   **WildFly Deployer Plugin** up to and including 1.0.2
*   **Worksoft Execution Manager Plugin** up to and including 10.0.3.503

**Fix**

*   Jenkins weekly should be updated to version 2.370
*   **Anchore Container Image Scanner Plugin** should be updated to version 1.0.25
*   **Compuware Common Configuration Plugin** should be updated to version 1.0.15
*   **NS-ND Integration Performance Publisher Plugin** should be updated to version 4.8.0.130

These versions include fixes to the vulnerabilities described above. All prior versions are considered to be affected by these vulnerabilities unless otherwise indicated.

As of publication of this advisory, no fixes are available for the following plugins:

*   Apprenda Plugin
*   BigPanda Notifier Plugin
*   Build-Publisher Plugin
*   CONS3RT Plugin
*   DotCi Plugin
*   extreme-feedback Plugin
*   NS-ND Integration Performance Publisher Plugin
*   RQM Plugin
*   Rundeck Plugin
*   SCM HttpClient Plugin
*   Security Inspector Plugin
*   SmallTest Plugin
*   View26 Test-Reporting Plugin
*   Walti Plugin
*   WildFly Deployer Plugin
*   Worksoft Execution Manager Plugin

Learn why we announce these issues.

**Credit**

The Jenkins project would like to thank the reporters for discovering and reporting these vulnerabilities:

*   **Daniel Beck, CloudBees, Inc.** for SECURITY-2169, SECURITY-2170, SECURITY-2645, SECURITY-2821, SECURITY-2884
*   **Jeff Thompson, CloudBees, Inc.** for SECURITY-2051
*   **Jesse Glick, CloudBees, Inc.** for SECURITY-2886
*   **Kevin Guerroudj, CloudBees, Inc.** for SECURITY-2237, SECURITY-2737, SECURITY-2805, SECURITY-2858, SECURITY-2867
*   **Long Nguyen, Viettel Cyber Security** for SECURITY-2068, SECURITY-2069
*   **Marc Heyries** for SECURITY-2243
*   **Matt Sicker, CloudBees, Inc.** for SECURITY-1994, SECURITY-2001
*   **Valdes Che Zogou, CloudBees, Inc.** for SECURITY-2708, SECURITY-2710, SECURITY-2751, SECURITY-2752, SECURITY-2832
*   **Valdes Che Zogou, CloudBees, Inc. and Kevin Guerroudj, CloudBees, Inc.** for SECURITY-2759
*   **Wadeck Follonier, CloudBees, Inc.** for SECURITY-1870, SECURITY-2139

CVE-2022-41226: Jenkins Security Advisory 2022-09-21

Jenkins DotCi Plugin 2.40.00 and earlier does not escape the GitHub user name parameter provided to commit notifications when displaying them in a build cause, resulting in a stored cross-site scripting (XSS) vulnerability.

This advisory announces vulnerabilities in the following Jenkins deliverables:

*   Jenkins (core)
*   Anchore Container Image Scanner Plugin
*   Apprenda Plugin
*   BigPanda Notifier Plugin
*   build-publisher Plugin
*   Compuware Common Configuration Plugin
*   CONS3RT Plugin
*   DotCi Plugin
*   extreme-feedback Plugin
*   NS-ND Integration Performance Publisher Plugin
*   NS-ND Integration Performance Publisher Plugin
*   RQM Plugin
*   Rundeck Plugin
*   SCM HttpClient Plugin
*   Security Inspector Plugin
*   SmallTest Plugin
*   View26 Test-Reporting Plugin
*   Walti Plugin
*   WildFly Deployer Plugin
*   Worksoft Execution Manager Plugin

**Descriptions****XSS vulnerability**

**SECURITY-2886 / CVE-2022-41224**  
**Severity (CVSS):** High  
**Description:**

Jenkins 2.367 through 2.369 (both inclusive) does not escape tooltips of the l:helpIcon UI component used for some help icons on the Jenkins web UI.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control tooltips for this component.

As of publication, the Jenkins security team is unaware of any exploitable help icon/tooltip in Jenkins core or plugins published by the Jenkins project. The vast majority of help icons use the l:help component instead of l:helpIcon. The few known instances of l:helpIcon do not have user-controllable contents.

Jenkins 2.370 escapes tooltips of the l:helpIcon UI component.

**Stored XSS vulnerability in Anchore Container Image Scanner Plugin**

**SECURITY-2821 / CVE-2022-41225**  
**Severity (CVSS):** High  
**Affected plugin: anchore-container-scanner**  
**Description:**

Anchore Container Image Scanner Plugin 1.0.24 and earlier does not escape content provided by the Anchore engine API.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control API responses by Anchore engine.

Anchore Container Image Scanner Plugin 1.0.25 escapes content provided by the Anchore engine API.

**XXE vulnerability in Compuware Common Configuration Plugin**

**SECURITY-2832 / CVE-2022-41226**  
**Severity (CVSS):** High  
**Affected plugin: compuware-common-configuration**  
**Description:**

Compuware Common Configuration Plugin 1.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers able to change the contents of the Topaz Workbench CLI home directory on agents to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

Compuware Common Configuration Plugin 1.0.15 disables external entity resolution for its XML parser.

**CSRF vulnerability and missing permission check in NS-ND Integration Performance Publisher Plugin**

**SECURITY-2737 / CVE-2022-41227 (CSRF), CVE-2022-41228 (missing permission check)**  
**Severity (CVSS):** Medium  
**Affected plugin: cavisson-ns-nd-integration**  
**Description:**

NS-ND Integration Performance Publisher Plugin 4.8.0.129 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified username and password.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

NS-ND Integration Performance Publisher Plugin 4.8.0.130 requires POST requests and Overall/Administer permission for the affected form validation method.

**Stored XSS vulnerability in NS-ND Integration Performance Publisher Plugin**

**SECURITY-2858 / CVE-2022-41229**  
**Severity (CVSS):** High  
**Affected plugin: cavisson-ns-nd-integration**  
**Description:**

NS-ND Integration Performance Publisher Plugin 4.8.0.134 and earlier does not escape configuration options of the Execute NetStorm/NetCloud Test build step.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

**Missing permission check in build-publisher Plugin**

**SECURITY-1994 / CVE-2022-41230**  
**Severity (CVSS):** Medium  
**Affected plugin: build-publisher**  
**Description:**

build-publisher Plugin 1.22 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to obtain names and URLs of Jenkins servers that the plugin is configured to publish builds to, as well as builds pending for publication to those Jenkins servers.

**Path traversal and CSRF vulnerability in build-publisher Plugin**

**SECURITY-2139 / CVE-2022-41231 (path traversal), CVE-2022-41232 (CSRF)**  
**Severity (CVSS):** High  
**Affected plugin: build-publisher**  
**Description:**

build-publisher Plugin 1.22 and earlier allows attackers with Item/Configure permission to create or replace any config.xml file on the Jenkins controller file system by providing a crafted file name to an API endpoint.

Additionally, this endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability that allows attackers to replace any config.xml file on the Jenkins controller file system with an empty file.

**Missing permission checks in Rundeck Plugin**

**SECURITY-2170 / CVE-2022-41233**  
**Severity (CVSS):** Medium  
**Affected plugin: rundeck**  
**Description:**

Rundeck Plugin 3.6.11 and earlier does not perform Run/Artifacts permission checks in multiple HTTP endpoints.

This allows attackers with Item/Read permission to obtain information about build artifacts of a given job, if the optional Run/Artifacts permission is enabled.

**Missing webhook endpoint authorization in Rundeck Plugin**

**SECURITY-2169 / CVE-2022-41234**  
**Severity (CVSS):** Medium  
**Affected plugin: rundeck**  
**Description:**

Rundeck Plugin 3.6.11 and earlier does not protect access to the /plugin/rundeck/webhook/ endpoint.

This allows attackers with Item/Read permission to trigger jobs that are configured to be triggerable via Rundeck.

**Path traversal vulnerability in WildFly Deployer Plugin allows reading arbitrary files**

**SECURITY-2645 / CVE-2022-41235**  
**Severity (CVSS):** Medium  
**Affected plugin: wildfly-deployer**  
**Description:**

WildFly Deployer Plugin 1.0.2 and earlier implements functionality that allows agent processes to read arbitrary files on the Jenkins controller file system.

This allows attackers able to control agent processes to read arbitrary files on the Jenkins controller file system.

This vulnerability is only exploitable in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. See the LTS upgrade guide.

**CSRF vulnerability in Security Inspector Plugin**

**SECURITY-2051 / CVE-2022-41236**  
**Severity (CVSS):** Medium  
**Affected plugin: security-inspector**  
**Description:**

Security Inspector Plugin 117.v6eecc36919c2 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to replace the generated report stored in a per-session cache and displayed to authorized users at the …​/report URL with a report based on attacker-specified report generation options. This could create confusion in users of the plugin who are expecting to see a different result.

A security hardening since Jenkins 2.287 and LTS 2.277.2 prevents exploitation of this vulnerability for the _Single user, multiple jobs_ report. Other report types are still affected.

**RCE vulnerability in DotCi Plugin**

**SECURITY-1737 / CVE-2022-41237**  
**Severity (CVSS):** High  
**Affected plugin: DotCi**  
**Description:**

DotCi Plugin 2.40.00 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types.

This results in a remote code execution (RCE) vulnerability exploitable by attackers able to modify .ci.yml files in SCM.

**Lack of authentication mechanism in DotCi Plugin webhook**

**SECURITY-2867 / CVE-2022-41238**  
**Severity (CVSS):** Medium  
**Affected plugin: DotCi**  
**Description:**

DotCi Plugin provides a webhook endpoint at /githook/ that can be used to trigger builds of the job for a GitHub repository.

In DotCi Plugin 2.40.00 and earlier, this endpoint can be accessed without authentication.

This allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository for attacker-specified commits.

**Stored XSS vulnerability in DotCi Plugin**

**SECURITY-2884 / CVE-2022-41239**  
**Severity (CVSS):** High  
**Affected plugin: DotCi**  
**Description:**

DotCi Plugin 2.40.00 and earlier does not escape the GitHub user name parameter provided to commit notifications when displaying them in a build cause.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to submit crafted commit notifications to the /githook/ endpoint (see also SECURITY-2867).

This vulnerability is only exploitable in Jenkins 2.314 and earlier, LTS 2.303.1 and earlier. See the LTS upgrade guide.

**Stored XSS vulnerability in Walti Plugin**

**SECURITY-1870 / CVE-2022-41240**  
**Severity (CVSS):** High  
**Affected plugin: walti**  
**Description:**

Walti Plugin 1.0.1 and earlier does not escape the information provided by the Walti API.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide malicious API responses from Walti.

**XXE vulnerability in RQM Plugin**

**SECURITY-2805 / CVE-2022-41241**  
**Severity (CVSS):** Medium  
**Affected plugin: rqm-plugin**  
**Description:**

RQM Plugin 2.8 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers able to provide crafted API responses from Rational Quality Manager to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

**Missing permission check in extreme-feedback Plugin**

**SECURITY-2001 / CVE-2022-41242**  
**Severity (CVSS):** Medium  
**Affected plugin: extreme-feedback**  
**Description:**

extreme-feedback Plugin 1.7 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to discover information about job names attached to lamps, discover MAC and IP addresses of existing lamps, and rename lamps.

**Missing hostname validation in SmallTest Plugin**

**SECURITY-2068 / CVE-2022-41243**  
**Severity (CVSS):** Medium  
**Affected plugin: smalltest**  
**Description:**

SmallTest Plugin 1.0.4 and earlier does not perform hostname validation when connecting to the configured SmallTest server.

This lack of validation could be abused using a man-in-the-middle attack to intercept these connections.

**Missing hostname validation in View26 Test-Reporting Plugin**

**SECURITY-2069 / CVE-2022-41244**  
**Severity (CVSS):** Medium  
**Affected plugin: view26**  
**Description:**

View26 Test-Reporting Plugin 1.0.7 and earlier does not perform hostname validation when connecting to the configured View26 server.

This lack of validation could be abused using a man-in-the-middle attack to intercept these connections.

**CSRF vulnerability and missing permission check in Worksoft Execution Manager Plugin allow capturing credentials**

**SECURITY-2237 / CVE-2022-41245 (CSRF), CVE-2022-41246 (missing permission check)**  
**Severity (CVSS):** Medium  
**Affected plugin: ws-execution-manager**  
**Description:**

Worksoft Execution Manager Plugin 10.0.3.503 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

**API key stored in plain text by BigPanda Notifier Plugin**

**SECURITY-2243 / CVE-2022-41247 (storage), CVE-2022-41248 (masking)**  
**Severity (CVSS):** Low  
**Affected plugin: bigpanda-jenkins**  
**Description:**

BigPanda Notifier Plugin 1.4.0 and earlier stores the BigPanda API key unencrypted in its global configuration file BigpandaGlobalNotifier.xml on the Jenkins controller as part of its configuration.

This API key can be viewed by users with access to the Jenkins controller file system.

Additionally, the global configuration form does not mask the API key, increasing the potential for attackers to observe and capture it.

**CSRF vulnerability and missing permission check in SCM HttpClient Plugin allow capturing credentials**

**SECURITY-2708 / CVE-2022-41249 (CSRF), CVE-2022-41250 (missing permission check)**  
**Severity (CVSS):** Medium  
**Affected plugin: scm-httpclient**  
**Description:**

SCM HttpClient Plugin 1.5 and earlier does not perform permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

**Missing permission check in Apprenda Plugin allows enumerating credentials IDs**

**SECURITY-2710 / CVE-2022-41251**  
**Severity (CVSS):** Medium  
**Affected plugin: apprenda**  
**Description:**

Apprenda Plugin 2.2.0 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

**Missing permission checks in CONS3RT Plugin allow enumerating credentials IDs**

**SECURITY-2752 / CVE-2022-41252**  
**Severity (CVSS):** Medium  
**Affected plugin: cons3rt**  
**Description:**

CONS3RT Plugin 1.0.0 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

**CSRF vulnerability and missing permission checks in CONS3RT Plugin allow capturing credentials**

**SECURITY-2751 / CVE-2022-41253 (CSRF), CVE-2022-41254 (missing permission check)**  
**Severity (CVSS):** Medium  
**Affected plugin: cons3rt**  
**Description:**

CONS3RT Plugin 1.0.0 and earlier does not perform permission checks in methods implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, these form validation methods do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

**API token stored in plain text by CONS3RT Plugin**

**SECURITY-2759 / CVE-2022-41255**  
**Severity (CVSS):** Low  
**Affected plugin: cons3rt**  
**Description:**

CONS3RT Plugin 1.0.0 and earlier stores Cons3rt API token unencrypted in job config.xml files on the Jenkins controller as part of its configuration.

This API token can be viewed by users with access to the Jenkins controller file system.

**Severity**

*   SECURITY-1737: High
*   SECURITY-1870: High
*   SECURITY-1994: Medium
*   SECURITY-2001: Medium
*   SECURITY-2051: Medium
*   SECURITY-2068: Medium
*   SECURITY-2069: Medium
*   SECURITY-2139: High
*   SECURITY-2169: Medium
*   SECURITY-2170: Medium
*   SECURITY-2237: Medium
*   SECURITY-2243: Low
*   SECURITY-2645: Medium
*   SECURITY-2708: Medium
*   SECURITY-2710: Medium
*   SECURITY-2737: Medium
*   SECURITY-2751: Medium
*   SECURITY-2752: Medium
*   SECURITY-2759: Low
*   SECURITY-2805: Medium
*   SECURITY-2821: High
*   SECURITY-2832: High
*   SECURITY-2858: High
*   SECURITY-2867: Medium
*   SECURITY-2884: High
*   SECURITY-2886: High

**Affected Versions**

*   Jenkins weekly up to and including 2.369
*   **Anchore Container Image Scanner Plugin** up to and including 1.0.24
*   **Apprenda Plugin** up to and including 2.2.0
*   **BigPanda Notifier Plugin** up to and including 1.4.0
*   **build-publisher Plugin** up to and including 1.22
*   **Compuware Common Configuration Plugin** up to and including 1.0.14
*   **CONS3RT Plugin** up to and including 1.0.0
*   **DotCi Plugin** up to and including 2.40.00
*   **extreme-feedback Plugin** up to and including 1.7
*   **NS-ND Integration Performance Publisher Plugin** up to and including 4.8.0.129
*   **NS-ND Integration Performance Publisher Plugin** up to and including 4.8.0.134
*   **RQM Plugin** up to and including 2.8
*   **Rundeck Plugin** up to and including 3.6.11
*   **SCM HttpClient Plugin** up to and including 1.5
*   **Security Inspector Plugin** up to and including 117.v6eecc36919c2
*   **SmallTest Plugin** up to and including 1.0.4
*   **View26 Test-Reporting Plugin** up to and including 1.0.7
*   **Walti Plugin** up to and including 1.0.1
*   **WildFly Deployer Plugin** up to and including 1.0.2
*   **Worksoft Execution Manager Plugin** up to and including 10.0.3.503

**Fix**

*   Jenkins weekly should be updated to version 2.370
*   **Anchore Container Image Scanner Plugin** should be updated to version 1.0.25
*   **Compuware Common Configuration Plugin** should be updated to version 1.0.15
*   **NS-ND Integration Performance Publisher Plugin** should be updated to version 4.8.0.130

These versions include fixes to the vulnerabilities described above. All prior versions are considered to be affected by these vulnerabilities unless otherwise indicated.

As of publication of this advisory, no fixes are available for the following plugins:

*   Apprenda Plugin
*   BigPanda Notifier Plugin
*   build-publisher Plugin
*   CONS3RT Plugin
*   DotCi Plugin
*   extreme-feedback Plugin
*   NS-ND Integration Performance Publisher Plugin
*   RQM Plugin
*   Rundeck Plugin
*   SCM HttpClient Plugin
*   Security Inspector Plugin
*   SmallTest Plugin
*   View26 Test-Reporting Plugin
*   Walti Plugin
*   WildFly Deployer Plugin
*   Worksoft Execution Manager Plugin

Learn why we announce these issues.

**Credit**

The Jenkins project would like to thank the reporters for discovering and reporting these vulnerabilities:

*   **Daniel Beck, CloudBees, Inc.** for SECURITY-2169, SECURITY-2170, SECURITY-2645, SECURITY-2821, SECURITY-2884
*   **Jeff Thompson, CloudBees, Inc.** for SECURITY-2051
*   **Jesse Glick, CloudBees, Inc.** for SECURITY-2886
*   **Kevin Guerroudj, CloudBees, Inc.** for SECURITY-2237, SECURITY-2737, SECURITY-2805, SECURITY-2858, SECURITY-2867
*   **Long Nguyen, Viettel Cyber Security** for SECURITY-2068, SECURITY-2069
*   **Marc Heyries** for SECURITY-2243
*   **Matt Sicker, CloudBees, Inc.** for SECURITY-1994, SECURITY-2001
*   **Valdes Che Zogou, CloudBees, Inc.** for SECURITY-2708, SECURITY-2710, SECURITY-2751, SECURITY-2752, SECURITY-2832
*   **Valdes Che Zogou, CloudBees, Inc. and Kevin Guerroudj, CloudBees, Inc.** for SECURITY-2759
*   **Wadeck Follonier, CloudBees, Inc.** for SECURITY-1870, SECURITY-2139

CVE-2022-41239: Jenkins Security Advisory 2022-09-21

A cross-site request forgery (CSRF) vulnerability in Jenkins Worksoft Execution Manager Plugin 10.0.3.503 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

CVE-2022-41245: Jenkins Security Advisory 2022-09-21

Jenkins DotCi Plugin 2.40.00 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.

CVE-2022-41237: Jenkins Security Advisory 2022-09-21

A missing permission check in Jenkins extreme-feedback Plugin 1.7 and earlier allows attackers with Overall/Read permission to discover information about job names attached to lamps, discover MAC and IP addresses of existing lamps, and rename lamps.

CVE-2022-41242: Jenkins Security Advisory 2022-09-21

Jenkins Build-Publisher Plugin 1.22 and earlier allows attackers with Item/Configure permission to create or replace any config.xml file on the Jenkins controller file system by providing a crafted file name to an API endpoint.

Tag

#mac