Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 25 Sep 2018 17:18:00 +0200
From: Daniel Beck <ml@...kweb.net>
To: oss-security@...ts.openwall.com
Subject: Multiple vulnerabilities in Jenkins plugins

Jenkins is an open source automation server which enables developers around
the world to reliably build, test, and deploy their software. The following
releases contain fixes for security vulnerabilities:

* Arachni Scanner Plugin 1.0.0
* Argus Notifier Plugin 1.0.2
* Artifactory Plugin 2.16.2
* Chatter Notifier Plugin 2.0.5
* Config File Provider Plugin 3.2
* Crowd 2 Integration Plugin 2.0.1
* Dimensions Plugin 0.8.15
* Email Extension Template Plugin 1.1
* Git Changelog Plugin 2.7
* HipChat Plugin 2.2.1
* JIRA Plugin 3.0.2
* Job Configuration History Plugin 2.18.1
* JUnit Plugin 1.26
* mesos Plugin 0.18
* Monitoring Plugin 1.74.0
* MQ Notifier Plugin 1.2.7
* PAM Authentication Plugin 1.4
* Publish Over Dropbox Plugin 1.2.5
* Rebuilder Plugin 1.29
* SonarQube Scanner Plugin 2.8.1

Additionally, these plugin have security vulnerabilities that have been made
public, but have no releases containing a fix yet:

* Metadata Plugin

Summaries of the vulnerabilities are below. More details, severity, and
attribution can be found here:
https://jenkins.io/security/advisory/2018-09-25/

We provide advance notification for security updates on this mailing list:
https://groups.google.com/d/forum/jenkinsci-advisories

If you discover security vulnerabilities in Jenkins, please report them as
described here:
https://jenkins.io/security/#reporting-vulnerabilities

---

SECURITY-1101
A URL used to allow setting the description of a test object in JUnit 
Plugin did not require POST requests, resulting in a cross-site request 
forgery vulnerability.


SECURITY-1029
Jira Plugin did not perform permission checks on a method implementing form 
validation. This allowed users with Overall/Read access to Jenkins to 
connect to an attacker-specified URL using attacker-specified credentials 
IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, this form validation method did not require POST requests, 
resulting in a cross-site request forgery vulnerability.


SECURITY-1080
Config File Provider Plugin did not escape configuration file metadata, 
resulting in a stored cross-site scripting (XSS) vulnerability.


SECURITY-938
A URL used to save configuration files based on form submissions in Config 
File Provider Plugin did not require POST requests, resulting in a CSRF 
vulnerability.


SECURITY-130
Rebuild Plugin did not escape parameter descriptions shown on the rebuild 
form page, resulting in a stored Cross-Site Scripting (XSS) vulnerability 
exploitable by users with the permission to configure jobs.


SECURITY-1130
Job Config History Plugin did not escape some query parameters shown on its 
pages, resulting in a reflected cross-site scripting (XSS) vulnerability.


SECURITY-1125
Some URLs implementing form submission handling in Email Extension Template 
Plugin did not require POST requests, resulting in a CSRF vulnerability 
that allowed attackers to create or remove templates.


SECURITY-984 (1)
HipChat Plugin did not perform permission checks on a method that sends 
test notifications. This allowed users with Overall/Read access to Jenkins 
to connect to an attacker-specified HipChat server using attacker-specified 
connection settings and credentials IDs obtained through another method, 
capturing credentials stored in Jenkins, and submitting messages to HipChat.

Additionally, this form validation method did not require POST requests, 
resulting in a cross-site request forgery vulnerability.


SECURITY-984 (2)
HipChat Plugin provides a list of applicable credential IDs to allow 
administrators configuring the plugin to select the one to use.

This functionality did not check permissions, allowing any user with 
Overall/Read permission to get a list of valid credentials IDs. Those could 
be used as part of an attack to capture the credentials using another 
vulnerability.


SECURITY-1013 (1)
Mesos Plugin provides a list of applicable credential IDs to allow 
administrators configuring the Mesos cloud to select the one to use.

This functionality did not check permissions, allowing any user with 
Overall/Read permission to get a list of valid credentials IDs. Those could 
be used as part of an attack to capture the credentials using another 
vulnerability.


SECURITY-1013 (2)
A missing permission check in a form validation method in Mesos Plugin 
allowed users with Overall/Read permission to initiate a connection test, 
connecting to an attacker-specified URL.

Additionally, this form validation method did not require POST requests, 
resulting in a CSRF vulnerability.


SECURITY-1067
Crowd 2 Integration Plugin did not perform permission checks on a method 
implementing form validation. This allowed users with Overall/Read access 
to Jenkins to connect to an attacker-specified URL with attacker-specified 
credentials and connection settings.

Additionally, this form validation method did not require POST requests, 
resulting in a CSRF vulnerability.


SECURITY-1068
Crowd 2 Integration Plugin stored the Crowd password unencrypted in its 
global configuration file on the Jenkins master. This password could be 
viewed by users with access to the master file system.


SECURITY-972
Users with Overall/Read permission were able to access MQ Notifier Plugin’s 
form validation URL, having it connect to an attacker-specified MQ system 
with attacker-specified credentials.

Additionally, this form validation URL did not require POST requests, 
resulting in a CSRF vulnerability.


SECURITY-1075
A stored cross-site scripting (XSS) vulnerability in Metadata Plugin allows 
users with permission to change metadata definitions to insert arbitrary 
HTML/Javascript into Jenkins pages.


SECURITY-1135
Metadata Plugin lacks a permission check that allows users with 
Overall/Read access to Jenkins to change the plugin’s configuration.


SECURITY-265
Artifactory Plugin 2.4.0 introduced support for securely storing 
credentials using the Credentials Plugin. Old, insecurely stored 
credentials however were not removed when switching to this new system.


SECURITY-813 / CVE-2017-12197
The pam4j library bundled in PAM Authentication Plugin had a bug that 
resulted in it not properly validating user accounts.


SECURITY-1163
SonarQube Scanner Plugin stored a server authentication token unencrypted 
in its global configuration file on the Jenkins master. This token could be 
viewed by users with access to the master file system.


SECURITY-1122
Git Changelog Plugin did not escape the Git commit messages it displayed 
since version 1.48, resulting in a stored cross-site scripting (XSS) 
vulnerability exploitable by users with commit access to specific Git 
repositories.


SECURITY-948
Arachni Scanner Plugin stored its password unencrypted in its global 
configuration file on the Jenkins master. This password could be viewed by 
users with access to the master file system.


SECURITY-1011 (1)
Argus Notifier Plugin did not perform permission checks on a method 
implementing form validation. This allowed users with Overall/Read access 
to Jenkins to connect to an attacker-specified URL using attacker-specified 
credentials IDs obtained through another method, capturing credentials 
stored in Jenkins.

Additionally, this form validation method did not require POST requests, 
resulting in a cross-site request forgery vulnerability.


SECURITY-1011 (2)
Argus Notifier Plugin provides a list of applicable credential IDs to allow 
administrators configuring the plugin to select the one to use.

This functionality did not check permissions, allowing any user with 
Overall/Read permission to get a list of valid credentials IDs. Those could 
be used as part of an attack to capture the credentials using another 
vulnerability.


SECURITY-1050 (1)
Chatter Notifier Plugin did not perform permission checks on a method 
implementing form validation. This allowed users with Overall/Read access 
to Jenkins to connect to an attacker-specified URL using attacker-specified 
credentials IDs obtained through another method, capturing credentials 
stored in Jenkins.

Additionally, this form validation method did not require POST requests, 
resulting in a cross-site request forgery vulnerability.


SECURITY-1050 (2)
Chatter Notifier Plugin provides a list of applicable credential IDs to 
allow users configuring the plugin’s functionality to select the one to use.

This functionality did not check permissions, allowing any user with 
Overall/Read permission to get a list of valid credentials IDs. Those could 
be used as part of an attack to capture the credentials using another 
vulnerability.


SECURITY-1065
Dimensions Plugin stored a password unencrypted in its global configuration 
file on the Jenkins master. This password could be viewed by users with 
access to the master file system.


SECURITY-1108
Users with Overall/Read permission were able to access Dimensions Plugin’s 
form validation URL, having it connect to an attacker-specified Dimensions 
system with attacker-specified credentials.

Additionally, this form validation URL did not require POST requests, 
resulting in a CSRF vulnerability.


SECURITY-845
Publish Over Dropbox Plugin stored authorization code and access code 
unencrypted in its global configuration file on the Jenkins master. These 
secrets could be viewed by users with access to the master file system.

Additionally, the authorization code was not masked from view using a 
password form field.


SECURITY-1156 / CVE-2018-15531
The JavaMelody library bundled in Monitoring Plugin is affected by an XML 
External Entity (XXE) processing vulnerability.

This allows attacker to send crafted requests to a web application for 
extraction of secrets from the file system, server-side request forgery, or 
denial-of-service attacks.

Monitoring plugin 1.74 updates its JavaMelody dependency to fix the issue.

The Jenkins security team and the maintainer of Monitoring Plugin have been 
unable to reproduce the issue in Jenkins, but we still recommend updating.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.