====================================================================

                             CERT-Renater

                 Note d'Information No. 2020/VULN533
_____________________________________________________________________

DATE                : 24/09/2020

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Implied Labels Plugin for Jenkins,
                                   Liquibase Runner Plugin for Jenkins,
                                   Liquibase Runner Plugin for Jenkins,
                                 Lockable Resources Plugin for Jenkins,
                                   Script Security Plugin for Jenkins,
                                   Warnings Plugin for Jenkins.

=====================================================================
https://www.jenkins.io/security/advisory/2020-09-23/
_____________________________________________________________________

 Jenkins Security Advisory 2020-09-23

This advisory announces vulnerabilities in the following Jenkins
deliverables:

    Implied Labels Plugin
    Liquibase Runner Plugin
    Liquibase Runner Plugin
    Lockable Resources Plugin
    Script Security Plugin
    Warnings Plugin


Descriptions


Sandbox bypass vulnerability in Script Security Plugin
SECURITY-2020 / CVE-2020-2279

Script Security Plugin provides a sandbox feature that allows low
privileged users to define scripts, including Pipelines, that are
generally safe to execute. Calls to code defined inside a sandboxed
script are intercepted, and various allowlists are checked to determine
whether the call is to be allowed.

In Script Security Plugin 1.74 and earlier, any calls from outside a
sandboxed script to code defined inside a sandboxed script were always
allowed. As sandboxed scripts can communicate their results through
script return values and similar mechanisms, this could result in code
defined inside of a sandboxed script to be called without sandbox
protection.

This vulnerability allows attackers with permission to define and run
sandboxed scripts, including Pipelines, to bypass the sandbox protection
and execute arbitrary code in the context of the Jenkins controller JVM.

Script Security Plugin 1.75 will prevent code defined inside a sandbox
from being invoked outside a sandboxed script.

In rare cases, invocations of sandboxed scripts may begin failing if the
script return value or script binding include code defined in the
sandbox and is further processed by the calling code. To resolve this
issue, the affected values need to be converted inside the sandboxed
script to a known safe type, such as String.

For compatibility with this change, the following plugins should be
upgraded to the versions specified:

    Email Extension Plugin should be updated to version 2.77 or newer.

    Warnings Next Generation Plugin should be updated to version 8.4.3
or newer.

    Warnings Plugin should be updated to version 5.0.2 or newer.


CSRF vulnerability in Warnings Plugin allows remote code execution
SECURITY-2042 / CVE-2020-2280

Warnings Plugin 5.0.1 and earlier does not require POST requests for a
form validation method intended for testing custom warnings parsers,
resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to execute arbitrary code.

Warnings Plugin 5.0.2 requires POST requests for the affected form
validation method.

This vulnerability was caused by an incomplete fix to SECURITY-1295.


CSRF vulnerability in Lockable Resources Plugin
SECURITY-1958 / CVE-2020-2281

Lockable Resources Plugin 2.8 and earlier does not require POST requests
for several HTTP endpoints, resulting in a cross-site request forgery
(CSRF) vulnerability.

This vulnerability allows attackers to reserve, unreserve, unlock, and
reset resources.

Lockable Resources Plugin 2.9 requires POST requests for the affected
HTTP endpoints.


Missing permission check in Implied Labels Plugin allows reconfiguring
the plugin
SECURITY-2004 / CVE-2020-2282

Implied Labels Plugin 0.6 and earlier does not perform a permission
check in an HTTP endpoint.

This allows attackers with Overall/Read permission to configure the
plugin.

Implied Labels Plugin 0.7 requires Overall/Administer permission to
configure the plugin.


Stored XSS vulnerability in Liquibase Runner Plugin
SECURITY-1885 / CVE-2020-2283

Liquibase Runner Plugin 1.4.5 and earlier does not escape changeset
contents when showing them on the build page.

This results in a stored cross-site scripting (XSS) vulnerability
exploitable by attackers able to provide Liquibase changesets evaluated
by the plugin.

Liquibase Runner Plugin 1.4.7 no longer supports evaluating changesets.


XXE vulnerability in Liquibase Runner Plugin
SECURITY-1887 / CVE-2020-2284

Liquibase Runner Plugin 1.4.5 and earlier does not configure its XML
parser to prevent XML external entity (XXE) attacks.

This allows attackers able to provide Liquibase changesets evaluated by
the plugin to have Jenkins parse a crafted XML file that uses external
entities for extraction of secrets from the Jenkins controller or
server-side request forgery.

Liquibase Runner Plugin 1.4.7 no longer parses Liquibase changesets.


Missing permission check in Liquibase Runner Plugin allows enumerating
credentials IDs
SECURITY-2030 / CVE-2020-2285

Liquibase Runner Plugin 1.4.7 and earlier does not perform a permission
check in an HTTP endpoint.

This allows attackers with Overall/Read permission to enumerate
credentials IDs of credentials stored in Jenkins. Those can be used as
part of an attack to capture the credentials using another
vulnerability.

An enumeration of credentials IDs in Liquibase Runner Plugin 1.4.8
requires the appropriate permissions.


Severity

    SECURITY-1885: High
    SECURITY-1887: High
    SECURITY-1958: Medium
    SECURITY-2004: Medium
    SECURITY-2020: High
    SECURITY-2030: Medium
    SECURITY-2042: High


Affected Versions

    Implied Labels Plugin up to and including 0.6
    Liquibase Runner Plugin up to and including 1.4.5
    Liquibase Runner Plugin up to and including 1.4.7
    Lockable Resources Plugin up to and including 2.8
    Script Security Plugin up to and including 1.74
    Warnings Plugin up to and including 5.0.1


Fix

    Implied Labels Plugin should be updated to version 0.7
    Liquibase Runner Plugin should be updated to version 1.4.7
    Liquibase Runner Plugin should be updated to version 1.4.8
    Lockable Resources Plugin should be updated to version 2.9
    Script Security Plugin should be updated to version 1.75
    Warnings Plugin should be updated to version 5.0.2

These versions include fixes to the vulnerabilities described above. All
prior versions are considered to be affected by these vulnerabilities
unless otherwise indicated.


Credit

The Jenkins project would like to thank the reporters for discovering
and reporting these vulnerabilities:

    Daniel Beck, CloudBees, Inc. for SECURITY-1885, SECURITY-1887,
     SECURITY-2030
    Devin Nusbaum, CloudBees, Inc. for SECURITY-2042
    Pierre Beitz, CloudBees, Inc. for SECURITY-1958
    Wadeck Follonier, CloudBees, Inc. and Daniel Beck, CloudBees, Inc.
     for SECURITY-2020


=========================================================
+ CERT-RENATER       |    tel : 01-53-94-20-44          +
+ 23/25 Rue Daviel   |    fax : 01-53-94-20-41          +
+ 75013 Paris        |    email:cert@support.renater.fr +
=========================================================