==================================================================== CERT-Renater Note d'Information No. 2020/VULN116 _____________________________________________________________________ DATE : 10/03/2020 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running Audit Trail Plugin for Jenkins, Backlog Plugin for Jenkins, Cobertura Plugin for Jenkins, CryptoMove Plugin for Jenkins, DeployHub Plugin for Jenkins, Git Plugin for Jenkins, Literate Plugin for Jenkins, Logstash Plugin for Jenkins, Mac Plugin for Jenkins, OpenShift Deployer Plugin for Jenkins, P4 Plugin for Jenkins, Quality Gates Plugin for Jenkins, Repository Connector Plugin for Jenkins, Rundeck Plugin for Jenkins, Script Security Plugin for Jenkins, Skytap Cloud CI Plugin for Jenkins, Sonar Quality Gates Plugin for Jenkins, Subversion Release Manager Plugin for Jenkins, Timestamper Plugin for Jenkins, Zephyr Enterprise Test Management Plugin for Jenkins, Zephyr for JIRA Test Management Plugin for Jenkins. ===================================================================== https://jenkins.io/security/advisory/2020-03-09/ _____________________________________________________________________ Jenkins Security Advisory 2020-03-09 This advisory announces vulnerabilities in the following Jenkins deliverables: Audit Trail Plugin Backlog Plugin Cobertura Plugin CryptoMove Plugin DeployHub Plugin Git Plugin Literate Plugin Logstash Plugin Mac Plugin OpenShift Deployer Plugin P4 Plugin Quality Gates Plugin Repository Connector Plugin Rundeck Plugin Script Security Plugin Skytap Cloud CI Plugin Sonar Quality Gates Plugin Subversion Release Manager Plugin Timestamper Plugin Zephyr Enterprise Test Management Plugin Zephyr for JIRA Test Management Plugin Descriptions Sandbox bypass vulnerability in Script Security Plugin SECURITY-1754 / CVE-2020-2134 (constructors), CVE-2020-2135 (GroovyInterceptable) Sandbox protection in Script Security Plugin 1.70 and earlier can be circumvented through: Crafted constructor calls and bodies (due to an incomplete fix of SECURITY-582) Crafted method calls on objects that implement GroovyInterceptable This allows attackers able to specify and run sandboxed scripts to execute arbitrary code in the context of the Jenkins master JVM. Script Security Plugin 1.71 has additional restrictions and sanity checks to ensure that super constructors cannot be constructed without being intercepted by the sandbox. In addition, it also intercepts method calls on objects that implement GroovyInterceptable as calls to GroovyObject#invokeMethod(String, Object), which is a blacklisted method. Stored XSS vulnerability in Git Plugin SECURITY-1723 / CVE-2020-2136 Git Plugin 4.2.0 and earlier does not escape the error message for the repository URL for Microsoft TFS field form validation. This results in a stored cross-site scripting vulnerability that can be exploited by users with Job/Configure permission. Git Plugin 4.2.1 escapes the affected part of the error message. Stored XSS vulnerability in Timestamper Plugin SECURITY-1784 / CVE-2020-2137 Timestamper Plugin 1.11.1 and earlier does not escape or sanitize the HTML formatting used to display the timestamps in console output for builds. This results in a stored cross-site scripting vulnerability that can be exploited by users with Overall/Administer permission. Timestamper Plugin 1.11.2 sanitizes the HTML formatting for timestamps and only allows basic, safe HTML formatting. XXE vulnerability in Cobertura Plugin SECURITY-1700 / CVE-2020-2138 Cobertura Plugin 1.15 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. This allows a user able to control the input files for the 'Publish Cobertura Coverage Report' post-build step to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins master or server-side request forgery. Cobertura Plugin 1.16 disables external entity resolution for its XML parser. Arbitrary file write vulnerability in Cobertura Plugin SECURITY-1668 / CVE-2020-2139 Cobertura Plugin 1.15 and earlier does not validate file paths from the XML file it parses. This allows attackers able to control the coverage report content to overwrite any file on the Jenkins master file system. Cobertura Plugin 1.16 sanitizes the file paths to prevent escape from the base directory. XSS vulnerability in Audit Trail Plugin SECURITY-1722 / CVE-2020-2140 Audit Trail Plugin 3.2 and earlier does not escape the error message for the URL Patterns field form validation. This results in a reflected cross-site scripting vulnerability that can also be exploited similar to a stored cross-site scripting vulnerability by users with Overall/Administer permission. Audit Trail Plugin 3.3 escapes the affected part of the error message. CSRF vulnerability and missing permission checks in P4 Plugin SECURITY-1765 / CVE-2020-2141 (CSRF), CVE-2020-2142 (missing permission check) P4 Plugin 1.10.10 and earlier does not perform permission checks in several HTTP endpoints. This allows users with Overall/Read access to trigger builds or add labels in the Perforce repository. Additionally, these endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability. P4 Plugin 1.10.11 requires POST requests and appropriate user permissions for the affected HTTP endpoints. Credentials transmitted in plain text by Logstash Plugin SECURITY-1516 / CVE-2020-2143 Logstash Plugin stores credentials in its global configuration file jenkins.plugins.logstash.LogstashConfiguration.xml on the Jenkins master as part of its configuration. While the credentials are stored encrypted on disk, they are transmitted in plain text as part of the configuration form by Logstash Plugin 2.3.1 and earlier. This can result in exposure of the credential through browser extensions, cross-site scripting vulnerabilities, and similar situations. Logstash Plugin 2.3.2 transmits the credentials in its global configuration encrypted. XXE vulnerability in Rundeck Plugin SECURITY-1702 / CVE-2020-2144 Rundeck Plugin 3.6.6 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. This allows a user with Overall/Read access to have Jenkins parse a crafted HTTP request with XML data that uses external entities for extraction of secrets from the Jenkins master or server-side request forgery. Rundeck Plugin 3.6.7 disables external entity resolution for its XML parser. Credentials stored in plain text by Zephyr Enterprise Test Management Plugin SECURITY-1596 / CVE-2020-2145 Zephyr Enterprise Test Management Plugin 1.9.1 and earlier stores its Zephyr password in plain text in the global configuration file com.thed.zephyr.jenkins.reporter.ZeeReporter.xml. This password can be viewed by users with access to the Jenkins master file system. Zephyr Enterprise Test Management Plugin 1.10 integrates with Credentials Plugin. Missing SSH host key validation in Mac Plugin SECURITY-1692 / CVE-2020-2146 Mac Plugin 1.1.0 and earlier does not use SSH host key validation when connecting to Mac Cloud host launched by the plugin. This lack of validation could be abused using a man-in-the-middle attack to intercept these connections to build agents. Mac Plugin 1.2.0 validates SSH host keys when connecting to agents. CSRF vulnerability and missing permission checks in Mac Plugin SECURITY-1761 / CVE-2020-2147 (CSRF), CVE-2020-2148 (missing permission check) Mac Plugin 1.1.0 and earlier does not perform permission checks on a method implementing form validation. This allows users with Overall/Read access to Jenkins to connect to an attacker-specified SSH host using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability. This form validation method requires POST requests and Overall/Administer permission in Mac Plugin 1.2.0. Credentials transmitted in plain text by Repository Connector Plugin SECURITY-1520 / CVE-2020-2149 Repository Connector Plugin stores credentials in its global configuration file org.jvnet.hudson.plugins.repositoryconnector.RepositoryConfiguration.xml on the Jenkins master as part of its configuration. While the credentials are stored encrypted on disk, they are transmitted in plain text as part of the configuration form by Repository Connector Plugin 1.2.6 and earlier. This can result in exposure of the credential through browser extensions, cross-site scripting vulnerabilities, and similar situations. As of publication of this advisory, there is no fix. Credentials transmitted in plain text by Sonar Quality Gates Plugin SECURITY-1523 / CVE-2020-2150 Sonar Quality Gates Plugin stores credentials in its global configuration file org.quality.gates.jenkins.plugin.GlobalConfig.xml on the Jenkins master as part of its configuration. While the credentials are stored encrypted on disk, they are transmitted in plain text as part of the configuration form by Sonar Quality Gates Plugin 1.3.1 and earlier. This can result in exposure of the credential through browser extensions, cross-site scripting vulnerabilities, and similar situations. As of publication of this advisory, there is no fix. Credentials transmitted in plain text by Quality Gates Plugin SECURITY-1519 / CVE-2020-2151 Quality Gates Plugin stores credentials in its global configuration file quality.gates.jenkins.plugin.GlobalConfig.xml on the Jenkins master as part of its configuration. While the credentials are stored encrypted on disk, they are transmitted in plain text as part of the configuration form by Quality Gates Plugin 2.5 and earlier. This can result in exposure of the credential through browser extensions, cross-site scripting vulnerabilities, and similar situations. As of publication of this advisory, there is no fix. XSS vulnerability in Subversion Release Manager Plugin SECURITY-1727 / CVE-2020-2152 Subversion Release Manager Plugin 1.2 and earlier does not escape the error message for the Repository URL field form validation. This results in a reflected cross-site scripting vulnerability that can also be exploited similar to a stored cross-site scripting vulnerability by users with Job/Configure permission. As of publication of this advisory, there is no fix. Credentials transmitted in plain text by Backlog Plugin SECURITY-1510 / CVE-2020-2153 Backlog Plugin stores credentials in job config.xml files as part of its configuration. While the credentials are stored encrypted on disk, they are transmitted in plain text as part of the configuration form by Backlog Plugin 2.4 and earlier. These credentials could be viewed by users with Extended Read permission. As of publication of this advisory, there is no fix. Credentials stored in plain text by Zephyr for JIRA Test Management Plugin SECURITY-1550 / CVE-2020-2154 Zephyr for JIRA Test Management Plugin 1.5 and earlier stores Jira credentials unencrypted in its global configuration file com.thed.zephyr.jenkins.reporter.ZfjReporter.xml on the Jenkins master. These credentials can be viewed by users with access to the master file system. As of publication of this advisory, there is no fix. Credentials transmitted in plain text by OpenShift Deployer Plugin SECURITY-1518 / CVE-2020-2155 OpenShift Deployer Plugin stores credentials in its global configuration file org.jenkinsci.plugins.openshift.DeployApplication.xml on the Jenkins master as part of its configuration. While the credentials are stored encrypted on disk, they are transmitted in plain text as part of the configuration form by OpenShift Deployer Plugin 1.2.0 and earlier. This can result in exposure of the credential through browser extensions, cross-site scripting vulnerabilities, and similar situations. As of publication of this advisory, there is no fix. Credentials transmitted in plain text by DeployHub Plugin SECURITY-1511 / CVE-2020-2156 DeployHub Plugin stores credentials in job config.xml files as part of its configuration. While the credentials are stored encrypted on disk, they are transmitted in plain text as part of the configuration form by DeployHub Plugin 8.0.14 and earlier. These credentials could be viewed by users with Extended Read permission. As of publication of this advisory, there is no fix. Credentials transmitted in plain text by Skytap Cloud CI Plugin SECURITY-1522 / CVE-2020-2157 Skytap Cloud CI Plugin stores credentials in job config.xml files as part of its configuration. While the credentials are stored encrypted on disk, they are transmitted in plain text as part of the configuration form by Skytap Cloud CI Plugin 2.07 and earlier. These credentials could be viewed by users with Extended Read permission. As of publication of this advisory, there is no fix. RCE vulnerability in Literate Plugin SECURITY-1750 / CVE-2020-2158 Literate Plugin 1.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types. This results in a remote code execution vulnerability exploitable by users able to provide YAML input files to Literate Plugin’s build step. As of publication of this advisory, there is no fix. OS command injection in CryptoMove Plugin SECURITY-1635 / CVE-2020-2159 CryptoMove Plugin 0.1.33 and earlier allows the configuration of an OS command to execute as part of its build step configuration. This command will be executed on the Jenkins master as the OS user account running Jenkins, allowing user with Job/Configure permission to execute an arbitrary OS command on the Jenkins master. As of publication of this advisory, there is no fix. Severity SECURITY-1510: Low SECURITY-1511: Low SECURITY-1516: Low SECURITY-1518: Low SECURITY-1519: Low SECURITY-1520: Low SECURITY-1522: Low SECURITY-1523: Low SECURITY-1550: Low SECURITY-1596: Low SECURITY-1635: High SECURITY-1668: Medium SECURITY-1692: Medium SECURITY-1700: High SECURITY-1702: High SECURITY-1722: Medium SECURITY-1723: Medium SECURITY-1727: Medium SECURITY-1750: High SECURITY-1754: High SECURITY-1761: Medium SECURITY-1765: Medium SECURITY-1784: Medium Affected Versions Audit Trail Plugin up to and including 3.2 Backlog Plugin up to and including 2.4 Cobertura Plugin up to and including 1.15 CryptoMove Plugin up to and including 0.1.33 DeployHub Plugin up to and including 8.0.14 Git Plugin up to and including 4.2.0 Literate Plugin up to and including 1.0 Logstash Plugin up to and including 2.3.1 Mac Plugin up to and including 1.1.0 OpenShift Deployer Plugin up to and including 1.2.0 P4 Plugin up to and including 1.10.10 Quality Gates Plugin up to and including 2.5 Repository Connector Plugin up to and including 1.2.6 Rundeck Plugin up to and including 3.6.6 Script Security Plugin up to and including 1.70 Skytap Cloud CI Plugin up to and including 2.07 Sonar Quality Gates Plugin up to and including 1.3.1 Subversion Release Manager Plugin up to and including 1.2 Timestamper Plugin up to and including 1.11.1 Zephyr Enterprise Test Management Plugin up to and including 1.9.1 Zephyr for JIRA Test Management Plugin up to and including 1.5 Fix Audit Trail Plugin should be updated to version 3.3 Cobertura Plugin should be updated to version 1.16 Git Plugin should be updated to version 4.2.1 Logstash Plugin should be updated to version 2.3.2 Mac Plugin should be updated to version 1.2.0 P4 Plugin should be updated to version 1.10.11 Rundeck Plugin should be updated to version 3.6.7 Script Security Plugin should be updated to version 1.71 Timestamper Plugin should be updated to version 1.11.2 Zephyr Enterprise Test Management Plugin should be updated to version 1.10 These versions include fixes to the vulnerabilities described above. All prior versions are considered to be affected by these vulnerabilities unless otherwise indicated. As of publication of this advisory, no fixes are available for the following plugins: Backlog Plugin CryptoMove Plugin DeployHub Plugin Literate Plugin OpenShift Deployer Plugin Quality Gates Plugin Repository Connector Plugin Skytap Cloud CI Plugin Sonar Quality Gates Plugin Subversion Release Manager Plugin Zephyr for JIRA Test Management Plugin Credit The Jenkins project would like to thank the reporters for discovering and reporting these vulnerabilities: Cheng Gao, Alibaba Cloud Intelligence Security Team, https://www.aliyun.com/ for SECURITY-1702 Federico Pellegrin for SECURITY-1668, SECURITY-1700 Ian Williams for SECURITY-1596 James Holderness, IB Boost for SECURITY-1510, SECURITY-1511, SECURITY-1516, SECURITY-1518, SECURITY-1519, SECURITY-1520, SECURITY-1522, SECURITY-1523, SECURITY-1550 Nils Emmerich of ERNW Research GmbH for SECURITY-1754 Raihaan Shouhell, Autodesk, Inc for SECURITY-1692 Wadeck Follonier, CloudBees, Inc. for SECURITY-1722, SECURITY-1723, SECURITY-1727, SECURITY-1761, SECURITY-1765, SECURITY-1784 Wasin Saengow for SECURITY-1635 ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================