====================================================================

                             CERT-Renater

                 Note d'Information No. 2020/VULN563
_____________________________________________________________________

DATE                : 09/10/2020

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Active Choices Plugin for Jenkins,
                           Audit Trail Plugin for Jenkins,
                           couchdb-statistics Plugin for Jenkins,
                           Maven Cascade Release Plugin for Jenkins,
                           Nerrvana Plugin for Jenkins,
                           Persona Plugin for Jenkins,
                           Release Plugin for Jenkins,
                   Role-based Authorization Strategy Plugin for Jenkins,
                           Shared Objects Plugin for Jenkins,
                           SMS Notification Plugin for Jenkins.

=====================================================================
https://www.jenkins.io/security/advisory/2020-10-08/
_____________________________________________________________________

 Jenkins Security Advisory 2020-10-08

This advisory announces vulnerabilities in the following Jenkins
deliverables:

    Active Choices Plugin
    Audit Trail Plugin
    couchdb-statistics Plugin
    Maven Cascade Release Plugin
    Nerrvana Plugin
    Persona Plugin
    Release Plugin
    Role-based Authorization Strategy Plugin
    Shared Objects Plugin
    SMS Notification Plugin


Descriptions

Improper authorization due to caching in Role-based Authorization
Strategy Plugin
SECURITY-1767 / CVE-2020-2286

Role-based Authorization Strategy Plugin 2.12 and newer uses a cache to
speed up permission lookups.

In Role-based Authorization Strategy Plugin 3.0 and earlier this cache
is not invalidated properly when an administrator changes the permission
configuration. This can result in permissions being granted long after
the configuration was changed to no longer grant them.

Role-based Authorization Strategy Plugin 3.1 properly invalidates the
cache on configuration changes.


Request logging could be bypassed in Audit Trail Plugin
SECURITY-1815 / CVE-2020-2287

Audit Trail Plugin logs requests whose URL path matches an
admin-configured regular expression.

A discrepancy between the behavior of the plugin and the Stapler web
framework in parsing URL paths allows attackers to craft URLs that would
bypass request logging in Audit Trail Plugin 3.6 and earlier. This only
applies to Jenkins 2.227 and earlier, LTS 2.204.5 and earlier, as the
fix for SECURITY-1774 prohibits dispatch of affected requests.

Audit Trail Plugin 3.7 processes request URL paths the same way as the
Stapler web framework.


Incorrect default pattern in Audit Trail Plugin
SECURITY-1846 / CVE-2020-2288

Audit Trail Plugin uses regular expressions to match requested URLs
whose dispatch should be logged.

In Audit Trail Plugin 3.6 and earlier, the default regular expression
pattern could be bypassed in many cases by adding a suffix to the URL
that would be ignored during request handling.

Audit Trail Plugin 3.7 changes the default regular expression pattern so
that it allows for arbitrary suffixes. It automatically will replace
previous default patterns with the new, more complete default pattern.

Additionally, an administrative monitor is shown if a user-specified
pattern is found to be bypassable through crafted URLs and form
validation was improved to recognize patterns that would not match
requests with arbitrary suffixes.


Stored XSS vulnerability in Active Choices Plugin
SECURITY-1954 / CVE-2020-2289

Active Choices Plugin 2.4 and earlier does not escape the name and
description of build parameters.

This results in a stored cross-site scripting (XSS) vulnerability
exploitable by attackers with Job/Configure permission.

Active Choices Plugin 2.5 escapes the name of build parameters and
applies the configured markup formatter to the description of build
parameters.


Stored XSS vulnerability in Active Choices Plugin
SECURITY-2008 / CVE-2020-2290

Active Choices Plugin 2.4 and earlier does not escape List and Map
return values of sandboxed scripts for Reactive Reference Parameter.

This results in a stored cross-site scripting (XSS) vulnerability
exploitable by attackers with Job/Configure permission.

This issue is caused by an incomplete fix for SECURITY-470.

Active Choices Plugin 2.5 escapes all legal return values of sandboxed
scripts.


Password stored in plain text by couchdb-statistics Plugin
SECURITY-2065 / CVE-2020-2291

couchdb-statistics Plugin 0.3 and earlier stores its server password
unencrypted in its global configuration file
org.jenkinsci.plugins.couchstats.CouchStatsConfig.xml on the Jenkins
controller as part of its configuration.

This password can be viewed by users with access to the Jenkins
controller file system.

couchdb-statistics Plugin 0.4 stores its server password encrypted once
its configuration is saved again.


Stored XSS vulnerability in Release Plugin
SECURITY-1928 / CVE-2020-2292

Release Plugin 2.10.2 and earlier does not escape the release version in
the badge tooltip.

This results in a stored cross-site scripting (XSS) vulnerability
exploitable by attackers with Release/Release permission.

As of publication of this advisory, there is no fix.


Arbitrary file read vulnerability in Persona Plugin
SECURITY-2046 / CVE-2020-2293

Persona Plugin 2.4 and earlier allows users with Overall/Read permission
to read arbitrary files on the Jenkins controller.

As of publication of this advisory, there is no fix.


CSRF vulnerability and missing permission checks in Maven Cascade
Release Plugin
SECURITY-2049 / CVE-2020-2294 (permission check), CVE-2020-2295 (CSRF)

Maven Cascade Release Plugin 1.3.2 and earlier does not perform
permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to start cascade
builds and layout builds, and reconfigure the plugin.

Additionally, these endpoints do not require POST requests, resulting in
a cross-site request forgery (CSRF) vulnerability.

As of publication of this advisory, there is no fix.


CSRF vulnerability in Shared Objects Plugin
SECURITY-2052 / CVE-2020-2296

Shared Objects Plugin 0.44 and earlier does not require POST requests
for an HTTP endpoint, resulting in a cross-site request forgery (CSRF)
vulnerability.

This vulnerability allows attackers to configure shared objects.

As of publication of this advisory, there is no fix.


Access token stored in plain text by SMS Notification Plugin
SECURITY-2054 / CVE-2020-2297

SMS Notification Plugin 1.2 and earlier stores an access token
unencrypted in its global configuration file
com.hoiio.jenkins.plugin.SMSNotification.xml on the Jenkins controller
as part of its configuration.

This access token can be viewed by users with access to the Jenkins
controller file system.

As of publication of this advisory, there is no fix.


XXE vulnerability in Nerrvana Plugin
SECURITY-2097 / CVE-2020-2298

Nerrvana Plugin 1.02.06 and earlier does not configure its XML parser to
prevent XML external entity (XXE) attacks.

This allows attackers with Overall/Read permission to have Jenkins parse
a crafted HTTP request with XML data that uses external entities for
extraction of secrets from the Jenkins controller or server-side request
forgery.

Additionally, XML parsing is exposed as a form validation endpoint that
does not require POST requests, allowing exploitation by users without
Overall/Read permission via CSRF.

As of publication of this advisory, there is no fix.


Severity

    SECURITY-1767: High
    SECURITY-1815: Medium
    SECURITY-1846: Medium
    SECURITY-1928: High
    SECURITY-1954: High
    SECURITY-2008: High
    SECURITY-2046: Medium
    SECURITY-2049: Medium
    SECURITY-2052: Medium
    SECURITY-2054: Low
    SECURITY-2065: Low
    SECURITY-2097: High


Affected Versions

    Active Choices Plugin up to and including 2.4
    Audit Trail Plugin up to and including 3.6
    couchdb-statistics Plugin up to and including 0.3
    Maven Cascade Release Plugin up to and including 1.3.2
    Nerrvana Plugin up to and including 1.02.06
    Persona Plugin up to and including 2.4
    Release Plugin up to and including 2.10.2
    Role-based Authorization Strategy Plugin up to and including 3.0
    Shared Objects Plugin up to and including 0.44
    SMS Notification Plugin up to and including 1.2


Fix

    Active Choices Plugin should be updated to version 2.5
    Audit Trail Plugin should be updated to version 3.7
    couchdb-statistics Plugin should be updated to version 0.4
    Role-based Authorization Strategy Plugin should be updated to
version 3.1

These versions include fixes to the vulnerabilities described above. All
prior versions are considered to be affected by these vulnerabilities
unless otherwise indicated.

As of publication of this advisory, no fixes are available for the
following plugins:

    Maven Cascade Release Plugin
    Nerrvana Plugin
    Persona Plugin
    Release Plugin
    Shared Objects Plugin
    SMS Notification Plugin


Credit

The Jenkins project would like to thank the reporters for discovering
and reporting these vulnerabilities:

    Daniel Beck, CloudBees, Inc. for SECURITY-1846, SECURITY-2046,
SECURITY-2097
    Daniel Beck, CloudBees, Inc. and Wadeck Follonier, CloudBees, Inc.
for SECURITY-1815
    Jeff Thompson, CloudBees, Inc. for SECURITY-2052
    Long Nguyen, Viettel Cyber Security for SECURITY-2054, SECURITY-2065
    Raihaan Shouhell, Autodesk, Inc for SECURITY-1767
    Wadeck Follonier, CloudBees, Inc. for SECURITY-1928, SECURITY-1954,
SECURITY-2008
    Wadeck Follonier, CloudBees, Inc. and Jeff Thompson, CloudBees, Inc.
for SECURITY-2049


=========================================================
+ CERT-RENATER       |    tel : 01-53-94-20-44          +
+ 23/25 Rue Daviel   |    fax : 01-53-94-20-41          +
+ 75013 Paris        |    email:cert@support.renater.fr +
=========================================================