Jenkins Plugin Flaw let Attackers Gain Admin Access

A recent security advisory from Jenkins reported that they had fixed 24 vulnerabilities affecting multiple Jenkins plugins.

This Flaw includes 5 High, 18 Medium, and 1 Low severity vulnerabilities.

Patches have been released for some of the affected plugins, while others are still under development.

Affected Plugins and their Versions

The list of affected Jenkins plugins includes,

• Active Directory Plugin up to and including 2.30
• Assembla Auth Plugin up to and including 1.14
• Benchmark Evaluator Plugin up to and including 1.0.1
• Datadog Plugin up to and including 5.4.1
• ElasticBox CI Plugin up to and including 5.0.1
• External Monitor Job Type Plugin up to and including 206.v9a_94ff0b_4a_10
• mabl Plugin up to and including 0.0.46
• MathWorks Polyspace Plugin up to and including 1.0.5
• OpenShift Login Plugin up to and including 1.1.0.227.v27e08dfb_1a_20
• Oracle Cloud Infrastructure Compute Plugin up to and including 1.0.16
• Orka by MacStadium Plugin up to and including 1.33
• Pipeline restFul API Plugin up to and including 0.11
• Rebuilder Plugin up to and including 320.v5a_0933a_e7d61
• SAML Single Sign On(SSO) Plugin up to and including 2.3.0
• Sumologic Publisher Plugin up to and including 2.2.1
• Test Results Aggregator Plugin up to and including 1.2.13

CVE(s):

The list of CVEs, severity, and their related affected plugin are as mentioned below,

High Severity Vulnerabilities

CVE-2023-37946: Session Fixation Vulnerability

This vulnerability exists due to improper session management in the OpenShift Login Plugin due to which previous sessions are not invalidated. This can allow threat actors to gain administrator access with social engineering techniques.

The CVSS Score for this vulnerability is yet to be confirmed.

CVE-2023-37957: CSRF vulnerability in Pipeline

This vulnerability exists due to the lack of POST requests to an HTTP endpoint which results in Cross-Site Request Forgery (CSRF).

An attacker can connect to Jenkins with an attacker-specified URL resulting in the impersonation of a victim with a newly generated JCLI token. The CVSS Score for this vulnerability is yet to be confirmed.

CVE-2023-37952, CVE-2023-37953: CSRF Vulnerability and Missing Permission

A vulnerability exists as several HTTP endpoints do not perform permission checks which allows threat actors to obtain the connection to Jenkins with Overall/Read permissions through attacker-specified URL and credential IDs collected with another method.

In addition to this, these endpoints do not require POST requests which result in Cross-Site Request Forgery. The CVSS Score for these vulnerabilities is yet to be confirmed.

CVE-2023-37942: XXE vulnerability in External Monitor

This vulnerability exists due to the misconfiguration of the XML parser, which prevents External XML Entity (XXE) attacks.

This allows threat actors to parse a crafted HTTP request with XML data that results in the extraction of sensitive information from Jenkins Controller or Server-Side Request Forgery (SSRF).

The CVSS Score for this vulnerability is yet to be confirmed.

Fixed Plugins

Jenkins has fixed some of the affected plugins, which include,

• Active Directory Plugin should be updated to version 2.30.1
• Datadog Plugin should be updated to version 5.4.2
• External Monitor Job Type Plugin should be updated to version 207.v98a_a_37a_85525
• mabl Plugin should be updated to version 0.0.47
• OpenShift Login Plugin should be updated to version 1.1.0.230.v5d7030b_f5432
• Oracle Cloud Infrastructure Compute Plugin should be updated to version 1.0.17
• Orka by MacStadium Plugin should be updated to version 1.34
• SAML Single Sign On(SSO) Plugin should be updated to version 2.3.1

Unfixed Plugins

The plugins for which fixes are not available include,

• Assembla Auth Plugin
• Benchmark Evaluator Plugin
• ElasticBox CI Plugin
• MathWorks Polyspace Plugin
• Pipeline restFul API Plugin
• Rebuilder Plugin
• Sumologic Publisher Plugin
• Test Results Aggregator Plugin

Users of these Jenkins plugins are advised to upgrade to the latest versions to avoid unauthorized access to systems. Other plugins are still being fixed, and patches are yet to be made available.

More details about all these vulnerabilities can be found on the Jenkins Security Advisory Page.