====================================================================

                             CERT-Renater

                 Note d'Information No. 2018/VULN055
_____________________________________________________________________

DATE                : 15/02/2018

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Jenkins versions prior to 2.107,
                                     LTS 2.89.4.

=====================================================================
https://jenkins.io/security/advisory/2018-02-14/
_____________________________________________________________________


Jenkins Security Advisory 2018-02-14

This advisory announces vulnerabilities in the following Jenkins
deliverables:

    Jenkins (core)


Descriptions

Improperly secured form validation for proxy configuration allowed
Server-Side Request Forgery


SECURITY-506 / CVE pending

The form validation for the proxy configuration form did not check the
permission of the user accessing it, allowing anyone with Overall/Read
access to Jenkins to cause Jenkins to send a GET request to a specified
URL, optionally with a specified proxy configuration.

If that request’s HTTP response code indicates success, the form
validation is returning a generic success message, otherwise the HTTP
status code is returned. It was not possible to reuse an existing proxy
configuration to send those requests; that configuration had to be
provided by the attacker.

The form validation now properly requires the Overall/Administer
permission.


Path traversal vulnerability allows access to files outside plugin
resources

SECURITY-705 / CVE-2018-6356

Jenkins did not properly prevent specifying relative paths that escape
a base directory for URLs accessing plugin resource files. This allowed
users with Overall/Read permission to download files from the Jenkins
master they should not have access to.

On Windows, any file accessible to the Jenkins master process could be
downloaded. On other operating systems, any file within the Jenkins
home directory accessible to the Jenkins master process could be
downloaded.

Jenkins now prevents specifying paths containing .. and other character
sequences that could be used to access files outside the plugins
resource directory.


Improper input validation allows unintended access to plugin resource
files on case-insensitive file systems

SECURITY-717 / CVE pending

Jenkins did not take into account case-insensitive file systems when
preventing access to plugin resource files that should not be
accessible. This allowed users with Overall/Read permission to download
plugin resource files in META-INF and WEB-INF directories, such as the
plugins' JAR files, which could contain hardcoded secrets.

This was caused by an incomplete fix to SECURITY-155.

Severity

    SECURITY-506: medium
    SECURITY-705: medium
    SECURITY-717: medium


Affected Versions

    Jenkins weekly up to and including 2.106
    Jenkins LTS up to and including 2.89.3


Fix

    Jenkins weekly should be updated to version 2.107
    Jenkins LTS should be updated to version 2.89.4

These versions include fixes to the vulnerabilities described above.
All prior versions are considered to be affected by these
vulnerabilities unless otherwise indicated.


Credit

The Jenkins project would like to thank the reporters for discovering
and reporting these vulnerabilities:

    Daniel Beck, CloudBees, Inc. for SECURITY-506, SECURITY-717
    Kapil Kulkarni for SECURITY-705


Other Resources

    Announcement blog post


==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================