====================================================================

                             CERT-Renater

                 Note d'Information No. 2021/VULN192
_____________________________________________________________________

DATE                : 01/04/2021

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Jenkins

=====================================================================
https://www.jenkins.io/security/advisory/2021-04-07/
_____________________________________________________________________

Jenkins Security Advisory 2021-04-07
This advisory announces vulnerabilities in the following Jenkins
deliverables:

Jenkins (core)
Micro Focus Application Automation Tools Plugin
promoted builds Plugin
Descriptions
Lack of type validation in agent related REST API
SECURITY-1721 / CVE-2021-21639
Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not validate the
type of object created after loading the data submitted to the
config.xml REST API endpoint of a node.

This allows attackers with Computer/Configure permission to replace a
node with one of a different type.

Jenkins 2.287, LTS 2.277.2 validates the type of object created and
rejects objects of unexpected types.

View name validation bypass
SECURITY-1871 / CVE-2021-21640
Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not properly
check that a newly created view has an allowed name. When a form to
create a view is submitted, the name is included twice in the
submission. One instance is validated, but the other instance is used to
create the value.

This allows attackers with View/Create permission to create views with
invalid or already-used names.

Jenkins 2.287, LTS 2.277.2 uses the same submitted value for validation
and view creation.

CSRF vulnerability in promoted builds Plugin
SECURITY-2293 / CVE-2021-21641
promoted builds Plugin 3.9 and earlier does not require POST requests
for HTTP endpoints implementing promotion (regular, forced, and
re-execute), resulting in cross-site request forgery (CSRF) vulnerabilities.

These vulnerabilities allow attackers to promote builds.

promoted builds Plugin 3.9.1 requires POST requests for the affected
HTTP endpoints.

NOTE
A security hardening since Jenkins 2.287 and LTS 2.277.2 prevents
exploitation of this vulnerability.
CSRF vulnerability and missing permission checks in Micro Focus
Application Automation Tools Plugin
SECURITY-2132 / CVE-2021-22512 (CSRF), CVE-2021-22513 (permission check)
Micro Focus Application Automation Tools Plugin 6.7 and earlier does not
perform permission checks in methods implementing form validation.

This allows attackers with Overall/Read permission to connect to
attacker-specified URLs using attacker-specified username and password.

Additionally, these form validation methods do not require POST
requests, resulting in a cross-site request forgery (CSRF) vulnerability.

Micro Focus Application Automation Tools Plugin 6.8 requires POST
requests and Overall/Administer permission for the affected form
validation methods.

Reflected XSS vulnerability in Micro Focus Application Automation Tools
Plugin
SECURITY-2175 / CVE-2021-22510
Micro Focus Application Automation Tools Plugin 6.7 and earlier does not
escape user input in a form validation response.

This results in a reflected cross-site scripting (XSS) vulnerability.

Micro Focus Application Automation Tools Plugin 6.8 escapes user input
in the affected form validation response.

NOTE
A security hardening since Jenkins 2.275 and LTS 2.263.2 prevents
exploitation of this vulnerability.
SSL/TLS certificate validation unconditionally disabled by Micro Focus
Application Automation Tools Plugin
SECURITY-2176 / CVE-2021-22511
Micro Focus Application Automation Tools Plugin 6.7 and earlier
unconditionally disables SSL/TLS certificate validation for connections
to Service Virtualization servers.

Micro Focus Application Automation Tools Plugin 6.8 no longer disables
SSL/TLS certificate validation unconditionally by default. It provides
an option to disable SSL/TLS certification validation for connections to
Service Virtualization servers.

Severity
SECURITY-1721: Low
SECURITY-1871: Medium
SECURITY-2132: Medium
SECURITY-2175: High
SECURITY-2176: Medium
SECURITY-2293: Medium
Affected Versions
Jenkins weekly up to and including 2.286
Jenkins LTS up to and including 2.277.1
Micro Focus Application Automation Tools Plugin up to and including 6.7
promoted builds Plugin up to and including 3.9
Fix
Jenkins weekly should be updated to version 2.287
Jenkins LTS should be updated to version 2.277.2
Micro Focus Application Automation Tools Plugin should be updated to
version 6.8
promoted builds Plugin should be updated to version 3.9.1
These versions include fixes to the vulnerabilities described above. All
prior versions are considered to be affected by these vulnerabilities
unless otherwise indicated.

Credit
The Jenkins project would like to thank the reporters for discovering
and reporting these vulnerabilities:

Ildefonso Montero Pérez, CloudBees, Inc. and Daniel Beck, CloudBees,
Inc. for SECURITY-2293
Jeff Thompson, CloudBees, Inc. for SECURITY-1721
Long Nguyen, Viettel Cyber Security for SECURITY-2132
Wadeck Follonier, CloudBees, Inc. for SECURITY-2175, SECURITY-2176


=========================================================
+ CERT-RENATER       |    tel : 01-53-94-20-44          +
+ 23/25 Rue Daviel   |    fax : 01-53-94-20-41          +
+ 75013 Paris        |    email:cert@support.renater.fr +
=========================================================