====================================================================

                             CERT-Renater

                 Note d'Information No. 2020/VULN179
_____________________________________________________________________

DATE                : 07/04/2020

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running AWSEB Deployment Plugin for
                                  Jenkins;
                         Code Coverage API Plugin for Jenkins;
                         FitNesse Plugin for Jenkins;
                         Gatling Plugin for Jenkins;
                         useMango Runner Plugin for Jenkins.

=====================================================================
https://jenkins.io/security/advisory/2020-04-07/
_____________________________________________________________________

 Jenkins Security Advisory 2020-04-07

This advisory announces vulnerabilities in the following Jenkins
deliverables:

    AWSEB Deployment Plugin
    Code Coverage API Plugin
    FitNesse Plugin
    Gatling Plugin
    useMango Runner Plugin


Descriptions


XXE vulnerability in Code Coverage API Plugin

SECURITY-1699 / CVE-2020-2172

Code Coverage API Plugin 1.1.4 and earlier does not configure its XML
parser to prevent XML external entity (XXE) attacks. This allows a user
able to control the input files for the "Publish Coverage Report"
post-build step to have Jenkins parse a crafted file that uses external
entities for extraction of secrets from the Jenkins master or
server-side request forgery.

Code Coverage API Plugin 1.1.5 disables external entity resolution for
its XML parser.


XSS vulnerability in Gatling Plugin
SECURITY-1633 / CVE-2020-2173

Gatling Plugin 1.2.7 and earlier serves Gatling reports in a manner that
bypasses the Content-Security-Policy protection introduced in Jenkins
1.641 and 1.625.3. This results in a cross-site scripting (XSS)
vulnerability exploitable by users able to change report content.

Gatling Plugin 1.3.0 no longer allows viewing Gatling reports directly
in Jenkins. Instead users need to download an archive containing the
report.


Reflected XSS vulnerability in AWSEB Deployment Plugin
SECURITY-1769 / CVE-2020-2174

AWSEB Deployment Plugin 0.3.19 and earlier does not escape various
values printed as part of form validation output.

This results in a reflected cross-site scripting (XSS) vulnerability.

AWSEB Deployment Plugin 0.3.20 escapes the values printed as part of the
affected form validation endpoints.


Stored XSS vulnerability in FitNesse Plugin
SECURITY-1801 / CVE-2020-2175

FitNesse Plugin 1.31 and earlier does not correctly escape report
contents before showing them on the Jenkins UI.

This results in a stored cross-site scripting (XSS) vulnerability
exploitable by users able to control the XML input files processed by
the plugin.

FitNesse Plugin 1.33 escapes content from XML input files before
rendering it on the Jenkins UI.


XSS vulnerability in useMango Runner Plugin
SECURITY-1780 / CVE-2020-2176

Multiple form validation endpoints in useMango Runner Plugin 1.4 and
earlier do not escape values received from the useMango service.

This results in a cross-site scripting (XSS) vulnerability exploitable
by users able to control the values returned from the useMango service.

useMango Runner Plugin 1.5 escapes all values received from the useMango
service in form validation messages.


Severity

    SECURITY-1633: Medium
    SECURITY-1699: High
    SECURITY-1769: Medium
    SECURITY-1780: Medium
    SECURITY-1801: Medium

Affected Versions

    AWSEB Deployment Plugin up to and including 0.3.19
    Code Coverage API Plugin up to and including 1.1.4
    FitNesse Plugin up to and including 1.31
    Gatling Plugin up to and including 1.2.7
    useMango Runner Plugin up to and including 1.4

Fix

    AWSEB Deployment Plugin should be updated to version 0.3.20
    Code Coverage API Plugin should be updated to version 1.1.5
    FitNesse Plugin should be updated to version 1.33
    Gatling Plugin should be updated to version 1.3.0
    useMango Runner Plugin should be updated to version 1.5

These versions include fixes to the vulnerabilities described above. All
prior versions are considered to be affected by these vulnerabilities
unless otherwise indicated.


Credit

The Jenkins project would like to thank the reporters for discovering
and reporting these vulnerabilities:

    Daniel Beck, CloudBees, Inc. for SECURITY-1633
    Federico Pellegrin for SECURITY-1699, SECURITY-1801
    Wadeck Follonier, CloudBees, Inc. for SECURITY-1769, SECURITY-1780


=========================================================
+ CERT-RENATER        | tel : 01-53-94-20-44            +
+ 23/25 Rue Daviel    | fax : 01-53-94-20-41            +
+ 75013 Paris         | email:cert@support.renater.fr   +
=========================================================