A cross-site request forgery (CSRF) vulnerability in Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

This advisory announces vulnerabilities in the following Jenkins deliverables:

*   CloudBees AWS Credentials Plugin
*   Dashboard View Plugin
*   dbCharts Plugin
*   Environment Dashboard Plugin
*   Extended Choice Parameter Plugin
*   Favorite Plugin
*   Folder-based Authorization Strategy Plugin
*   GitLab Authentication Plugin
*   global-build-stats Plugin
*   incapptic connect uploader Plugin
*   Kubernetes Continuous Deploy Plugin
*   List Git Branches Parameter Plugin
*   Parameterized Trigger Plugin
*   Release Helper Plugin
*   Semantic Versioning Plugin
*   Vmware vRealize CodeStream Plugin

**Descriptions****Sensitive parameter values captured in build metadata files by Parameterized Trigger Plugin**

**SECURITY-2185 / CVE-2022-27195**

Parameterized Trigger Plugin 2.43 and earlier captures environment variables passed to builds triggered using Parameterized Trigger Plugin, including password parameter values, in their build.xml files. These values are stored unencrypted and can be viewed by users with access to the Jenkins controller file system.

Parameterized Trigger Plugin 2.43.1 does not store captured environment variables in build.xml files.

Note

Existing build.xml files are not automatically updated to remove captured environment variables. They need to be manually cleaned up. To help with this, the plugin will report environment variables stored in build.xml as unloadable data in the Old Data Monitor, that allows discarding this data. Build records are only loaded from disk when needed however, so some builds stored in Jenkins may not immediately appear there.

**Stored XSS vulnerability in Favorite Plugin**

**SECURITY-2557 / CVE-2022-27196**

Favorite Plugin 2.4.0 and earlier does not escape the names of jobs in the favorite column.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure or Item/Create permissions.

Favorite Plugin 2.4.1 escapes the names of jobs in the favorite column.

**Stored XSS vulnerability in Dashboard View Plugin**

**SECURITY-2559 / CVE-2022-27197**

Dashboard View Plugin 2.18 and earlier does not perform URL validation for the Iframe Portlet’s Iframe source URL.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure views.

Dashboard View Plugin 2.18.1 performs URL validation for the Iframe Portlet’s Iframe source URL.

Additionally, Dashboard View Plugin 2.18.1 sets the sandbox attribute for the iframe to restrict the included page.

Note

In case of problems, the Java system property hudson.plugins.view.dashboard.core.IframePortlet.sandboxAttributeValue can be used to customize the sandbox attribute value. The Java system property hudson.plugins.view.dashboard.core.IframePortlet.doNotUseSandbox can be used to disable the sandbox completely.

**CSRF vulnerability and missing permission checks in CloudBees AWS Credentials Plugin**

**SECURITY-2351 / CVE-2022-27198 (CSRF), CVE-2022-27199 (permission check)**

CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

This form validation method requires POST requests and Overall/Administer permission in CloudBees AWS Credentials Plugin 191.vcb\_f183ce58b\_9.

**Stored XSS vulnerability in Folder-based Authorization Strategy Plugin**

**SECURITY-2646 / CVE-2022-27200**

Folder-based Authorization Strategy Plugin 1.3 and earlier does not escape the names of roles shown on the configuration form.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer permission.

Folder-based Authorization Strategy Plugin 1.4 escapes the names of roles shown on the configuration form.

**Agent-to-controller security bypass in Semantic Versioning Plugin**

**SECURITY-2124 / CVE-2022-27201**

Semantic Versioning Plugin defines a controller/agent message that processes a given file as XML and returns version information. The XML parser is not configured to prevent XML external entity (XXE) attacks, which is only a problem if XML documents are parsed on the Jenkins controller.

Semantic Versioning Plugin 1.13 and earlier does not restrict execution of the controller/agent message to agents, and implements no limitations about the file path that can be parsed. This allows attackers able to control agent processes to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

Note

This vulnerability is only exploitable in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. See the LTS upgrade guide.

Semantic Versioning Plugin 1.14 does not allow the affected controller/agent message to be submitted by agents for execution on the controller.

**Stored XSS vulnerability in Extended Choice Parameter Plugin**

**SECURITY-2232 / CVE-2022-27202**

Extended Choice Parameter Plugin 346.vd87693c5a\_86c and earlier does not escape the value and description of Extended Choice Parameters with parameter type 'Radio Buttons' or 'Check Boxes'.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

As of publication of this advisory, there is no fix.

**Arbitrary JSON and property file read vulnerability in Extended Choice Parameter Plugin**

**SECURITY-1351 / CVE-2022-27203**

Extended Choice Parameter Plugin 346.vd87693c5a\_86c and earlier allows attackers with Item/Configure permission to read values from arbitrary JSON and Java properties files on the Jenkins controller.

As of publication of this advisory, there is no fix.

**CSRF vulnerability and missing permission checks in Extended Choice Parameter Plugin allow SSRF**

**SECURITY-1350 / CVE-2022-27204 (CSRF), CVE-2022-27205 (permission check)**

Extended Choice Parameter Plugin 346.vd87693c5a\_86c and earlier does not perform a permission check on form validation methods. This allows attackers with Overall/Read permission to connect to an attacker-specified URL.

Additionally, these form validation methods do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

As of publication of this advisory, there is no fix.

**Client Secret stored in plain text by GitLab Authentication Plugin**

**SECURITY-1891 / CVE-2022-27206**

GitLab Authentication Plugin 1.13 and earlier stores the GitLab client secret unencrypted in the global config.xml file on the Jenkins controller as part of its configuration.

This client secret can be viewed by users with access to the Jenkins controller file system.

As of publication of this advisory, there is no fix.

**Stored XSS vulnerability in global-build-stats Plugin**

**SECURITY-1886 / CVE-2022-27207**

global-build-stats Plugin 1.5 and earlier does not escape multiple fields in the chart configuration on the 'Global Build Stats' page.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer permission.

As of publication of this advisory, there is no fix.

**Arbitrary file read vulnerability in Kubernetes Continuous Deploy Plugin**

**SECURITY-2096 / CVE-2022-27208**

Kubernetes Continuous Deploy Plugin contributes the 'Kubernetes configuration (kubeconfig)' credential type.

Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows users with Credentials/Create or Credentials/Update permission to read arbitrary files on the Jenkins controller by defining a 'From a file on the Jenkins master' Kubeconfig source for such a credential.

As of publication of this advisory, there is no fix.

**Missing permission checks in Kubernetes Continuous Deploy Plugin allow enumerating credentials IDs**

**SECURITY-2636 / CVE-2022-27209**

Kubernetes Continuous Deploy Plugin 2.3.1 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

As of publication of this advisory, there is no fix.

**CSRF vulnerability and missing permission checks in Kubernetes Continuous Deploy Plugin allow capturing credentials**

**SECURITY-2681 / CVE-2022-27210 (CSRF), CVE-2022-27211 (permission check)**

Kubernetes Continuous Deploy Plugin 2.3.1 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, this endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

As of publication of this advisory, there is no fix.

**Stored XSS vulnerability in List Git Branches Parameter Plugin**

**SECURITY-2167 / CVE-2022-27212**

List Git Branches Parameter Plugin 0.0.9 and earlier does not escape the name or default value of the 'List Git branches (and more)' parameter. Additionally, List Git Branches Parameter Plugin explicitly disables a protection mechanism introduced in Jenkins 2.44 and LTS 2.32.2 to prevent exploitation of unescaped parameter names.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

As of publication of this advisory, there is no fix.

**Stored XSS vulnerability in Environment Dashboard Plugin**

**SECURITY-2252 / CVE-2022-27213**

Environment Dashboard Plugin 1.1.10 and earlier does not escape the Environment order and the Component order configuration values in its views.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Configure permission.

As of publication of this advisory, there is no fix.

**CSRF vulnerability and missing permission checks in Release Helper Plugin**

**SECURITY-2274 / CVE-2022-27214 (CSRF), CVE-2022-27215 (permission check)**

Release Helper Plugin 1.3.3 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

As of publication of this advisory, there is no fix.

**Passwords stored in plain text by dbCharts Plugin**

**SECURITY-2159 / CVE-2022-27216**

dbCharts Plugin 0.5.2 and earlier stores JDBC connection passwords unencrypted in its global configuration file hudson.plugins.dbcharts.DbChartPublisher.xml on the Jenkins controller as part of its configuration.

These passwords can be viewed by users with access to the Jenkins controller file system.

As of publication of this advisory, there is no fix.

**Passwords stored in plain text by Vmware vRealize CodeStream Plugin**

**SECURITY-2238 / CVE-2022-27217**

Vmware vRealize CodeStream Plugin 1.2 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller as part of its configuration.

These passwords can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

As of publication of this advisory, there is no fix.

**Personal tokens stored in plain text by incapptic connect uploader Plugin**

**SECURITY-2273 / CVE-2022-27218**

incapptic connect uploader Plugin 1.15 and earlier stores personal tokens unencrypted in job config.xml files on the Jenkins controller as part of its configuration.

These tokens can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

As of publication of this advisory, there is no fix.

**Severity**

*   SECURITY-1350: Medium
*   SECURITY-1351: Medium
*   SECURITY-1886: Medium
*   SECURITY-1891: Low
*   SECURITY-2096: Medium
*   SECURITY-2124: High
*   SECURITY-2159: Low
*   SECURITY-2167: High
*   SECURITY-2185: Low
*   SECURITY-2232: High
*   SECURITY-2238: Medium
*   SECURITY-2252: High
*   SECURITY-2273: Medium
*   SECURITY-2274: Medium
*   SECURITY-2351: Medium
*   SECURITY-2557: High
*   SECURITY-2559: High
*   SECURITY-2636: Medium
*   SECURITY-2646: Medium
*   SECURITY-2681: High

**Affected Versions**

*   **CloudBees AWS Credentials Plugin** up to and including 189.v3551d5642995
*   **Dashboard View Plugin** up to and including 2.18
*   **dbCharts Plugin** up to and including 0.5.2
*   **Environment Dashboard Plugin** up to and including 1.1.10
*   **Extended Choice Parameter Plugin** up to and including 346.vd87693c5a\_86c
*   **Favorite Plugin** up to and including 2.4.0
*   **Folder-based Authorization Strategy Plugin** up to and including 1.3
*   **GitLab Authentication Plugin** up to and including 1.13
*   **global-build-stats Plugin** up to and including 1.5
*   **incapptic connect uploader Plugin** up to and including 1.15
*   **Kubernetes Continuous Deploy Plugin** up to and including 2.3.1
*   **List Git Branches Parameter Plugin** up to and including 0.0.9
*   **Parameterized Trigger Plugin** up to and including 2.43
*   **Release Helper Plugin** up to and including 1.3.3
*   **Semantic Versioning Plugin** up to and including 1.13
*   **Vmware vRealize CodeStream Plugin** up to and including 1.2

**Fix**

*   **CloudBees AWS Credentials Plugin** should be updated to version 191.vcb\_f183ce58b\_9
*   **Dashboard View Plugin** should be updated to version 2.18.1
*   **Favorite Plugin** should be updated to version 2.4.1
*   **Folder-based Authorization Strategy Plugin** should be updated to version 1.4
*   **Parameterized Trigger Plugin** should be updated to version 2.43.1
*   **Semantic Versioning Plugin** should be updated to version 1.14

These versions include fixes to the vulnerabilities described above. All prior versions are considered to be affected by these vulnerabilities unless otherwise indicated.

As of publication of this advisory, no fixes are available for the following plugins:

*   dbCharts Plugin
*   Environment Dashboard Plugin
*   Extended Choice Parameter Plugin
*   GitLab Authentication Plugin
*   global-build-stats Plugin
*   incapptic connect uploader Plugin
*   Kubernetes Continuous Deploy Plugin
*   List Git Branches Parameter Plugin
*   Release Helper Plugin
*   Vmware vRealize CodeStream Plugin

**Credit**

The Jenkins project would like to thank the reporters for discovering and reporting these vulnerabilities:

*   **Daniel Beck, CloudBees, Inc.** for SECURITY-2124, SECURITY-2681
*   **Gunther Rademacher** for SECURITY-2185
*   **Jesse Glick, CloudBees, Inc.** for SECURITY-2096
*   **Justin Philip** for SECURITY-2252
*   **Kevin Guerroudj** for SECURITY-2232, SECURITY-2238
*   **Kevin Guerroudj, CloudBees, Inc.** for SECURITY-2636, SECURITY-2646
*   **Kevin Guerroudj, CloudBees, Inc. and Wadeck Follonier, CloudBees, Inc.** for SECURITY-2557
*   **Matt Sicker, CloudBees, Inc. and, independently, Marc Heyries** for SECURITY-1891
*   **Oleg Nenashev, CloudBees, Inc.** for SECURITY-1350, SECURITY-1351
*   **Quentin Parra** for SECURITY-2273, SECURITY-2274
*   **Son Nguyen (@s0nnguy3n\_)** for SECURITY-2159
*   **Son Nguyen (@s0nnguy3n\_), and, independently, Kevin Guerroudj** for SECURITY-2167
*   **Wadeck Follonier, CloudBees, Inc. and Kevin Guerroudj, CloudBees, Inc.** for SECURITY-2559
*   **Wadeck Follonier, CloudBees, Inc., and, independently, Kevin Guerroudj** for SECURITY-1886

CVE-2022-27210: Jenkins Security Advisory 2022-03-15

If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes. This issue affects Apache HTTP Server 2.4.52 and earlier.

CVE-2022-22721: Apache HTTP Server 2.4 vulnerabilities

In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects.

JetBrains Security

**JetBrains Security Bulletin Q4 2021**

In the fourth quarter of 2021, we resolved a number of security issues in our products. Here’s a summary report that contains a description of each issue and the version in which it was resolved.

**Product**

**Description**

**Severity**

**Resolved in**

**CVE/CWE**

Datalore

Another user’s database could be attached (DL-9779)

High

Not applicable

Not applicable

Hub

JetBrains Account integration exposed API keys with excessive permissions. Reported by Yurii Sanin (HUB-10958)

High

2021.1.13890

CVE-2022-24327

Hub

An unprivileged user could perform a DoS. Reported by Yurii Sanin (HUB-10976)

High

2021.1.13956

CVE-2022-24328

IntelliJ IDEA

Code could be executed without the user’s permission on opening a project (IDEA-243002, IDEA-277306, IDEA-282396, IDEA-275917)

Medium

2021.2.4

CVE-2022-24345

IntelliJ IDEA

Potential LCE via RLO (Right-to-Left Override) characters (IDEA-284150)

Medium

2021.3.1

CVE-2022-24346

JetBrains Blog

Blind SQL injection. Reported by Khan Janny (BLOG-45)

Medium

Not applicable

Not applicable

Kotlin

No ability to lock dependencies for Kotlin Multiplatform Gradle projects. Reported by Carter Jernigan (KT-49449)

Medium

1.6.0

CVE-2022-24329

Kotlin websites

Clickjacking at kotlinlang.org (KTL-588)

Medium

Not applicable

Not applicable

Remote Development

Unexpected open port on backend server. Please refer to this blog post for additional details. Reported by Damian Gwiżdż (GTW-894)

High

Not 2021.3.1

CVE-2021-45977

Space

Missing permission check in an HTTP API response (SPACE-15991)

High

Not applicable

Not applicable

TeamCity

A redirect to an external site was possible (TW-71113)

Low

2021.2.1

CVE-2022-24330

TeamCity

Logout failed to remove the “Remember Me” cookie (TW-72969)

Low

2021.2

CVE-2022-24332

TeamCity

GitLab authentication impersonation. Reported by Christian Pedersen (TW-73375)

High

2021.1.4

CVE-2022-24331

TeamCity

The “Agent push” feature allowed any private key on the server to be selected (TW-73399)

Low

2021.2.1

CVE-2022-24334

TeamCity

Blind SSRF via an XML-RPC call. Reported by Artem Godin (TW-73465)

Medium

2021.2

CVE-2022-24333

TeamCity

Time-of-check/Time-of-use (TOCTOU) vulnerability in agent registration via XML-RPC. Reported by Artem Godin (TW-73468)

High

2021.2

CVE-2022-24335

TeamCity

An unauthenticated attacker could cancel running builds via an XML-RPC request to the TeamCity server. Reported by Artem Godin (TW-73469)

Medium

2021.2.1

CVE-2022-24336

TeamCity

Pull-requests’ health items were shown to users without appropriate permissions (TW-73516)

Low

2021.2

CVE-2022-24337

TeamCity

Stored XSS. Reported by Yurii Sanin (TW-73737)

Medium

2021.2.1

CVE-2022-24339

TeamCity

URL injection leading to CSRF. Reported by Yurii Sanin (TW-73859)

Medium

2021.2.1

CVE-2022-24342

TeamCity

Changing a password failed to terminate sessions of the edited user (TW-73888)

Low

2021.2.1

CVE-2022-24341

TeamCity

XXE during the parsing of a configuration file (TW-73932)

Medium

2021.2.1

CVE-2022-24340

TeamCity

Reflected XSS (TW-74043)

Medium

2021.2.1

CVE-2022-24338

TeamCity

Stored XSS on the Notification templates page (JT-65752))

Low

2021.4.31698

CVE-2022-24344

YouTrack

A custom logo could be set with read-only permissions (JT-66214)

Low

2021.4.31698

CVE-2022-24343

YouTrack

Stored XSS via project icon. Reported by Yurii Sanin (JT-67176)

Medium

2021.4.36872

CVE-2022-24347

If you need any further assistance, please contact our Security Team.

Subscribe to receive the bulletin in your mailbox.

Your JetBrains Team_  
The Drive to Develop_

**Subscribe to Blog updates**

CVE-2022-24329: JetBrains Security Bulletin Q4 2021 | Company Blog

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.8.

**Description**

url-parse is unable to find the correct hostname when no port number is provided in the url.

Payload: http://example.com:

**Proof of Concept**

    var Url = require('url-parse');
    var PAYLOAD = "http://example.com:";
    
    // Expected hostname: example.com
    // Actual hostname by url-parse: example.com:
    console.log(Url(PAYLOAD));
    

_OUTPUT:_

    {
      slashes: true,
      protocol: 'http:',
      hash: '',
      query: '',
      pathname: '/',
      auth: '',
      host: 'example.com:',
      port: '',
      hostname: 'example.com:',
      password: '',
      username: '',
      origin: 'http://example.com:',
      href: 'http://example.com:/'
    }
    

**Impact**

It can lead to SSRF, Open Redirect or any other vulnerability which depends on the hostname field of parsed url.

**Occurrences**

CVE-2022-0686: Authorization Bypass Through User-Controlled Key in url-parse

Authorization Bypass Through User-Controlled Key in NPM urijs prior to 1.19.8.

**Description**

Bypass for https://huntr.dev/bounties/1625558772840-medialize/URI.js/

urijs fixed the issue for CVE-2021-3647, however an attacker can still exploit the issue due to case-sensitive checks in the earlier patch. Attacker can use case-insensitive protocol schemes like HTTP, htTP, HTtp etc. in order to bypass the patch for that bug.

**Proof of Concept**

    var URI = require('urijs');
    var url = new URI("HTTPS:///github.com/abc"); 
    console.log(url);
    

**OUTPUT:**

    URI {
      _string: '',
      _parts: {
        protocol: 'HTTPS',
        username: null,
        password: null,
        hostname: null,
        urn: null,
        port: null,
        path: '/github.com/abc',
        query: null,
        fragment: null,
        preventInvalidHostname: false,
        duplicateQueryParameters: false,
        escapeQuerySpace: true
      },
      _deferred_build: true
    }
    

**Impact**

Bypass host-validation checks, open redirect, SSRF etc. - depends on the usage of urijs

**Occurrences**

CVE-2022-0613: Authorization Bypass Through User-Controlled Key in uri.js

Missing permission checks in Jenkins Checkmarx Plugin 2022.1.2 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

CVE-2022-25201: Jenkins Security Advisory 2022-02-15

A cross-site request forgery (CSRF) vulnerability in Jenkins SCP publisher Plugin 1.8 and earlier allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials.

CVE-2022-25198: Jenkins Security Advisory 2022-02-15

Jenkins Fortify Plugin 20.2.34 and earlier does not sanitize the appName and appVersion parameters of its Pipeline steps, allowing attackers with Item/Configure permission to write or overwrite .xml files on the Jenkins controller file system with content not controllable by the attacker.

CVE-2022-25188: Jenkins Security Advisory 2022-02-15

A sandbox bypass vulnerability in Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier allows attackers with Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM through crafted SCM contents, if a global Pipeline library already exists.

CVE-2022-25181: Jenkins Security Advisory 2022-02-15

Jenkins HashiCorp Vault Plugin 3.8.0 and earlier implements functionality that allows agent processes to retrieve any Vault secrets for use on the agent, allowing attackers able to control agent processes to obtain Vault secrets for an attacker-specified path and key.

Tag

#ssrf