====================================================================

                             CERT-Renater

                 Note d'Information No. 2021/VULN289
_____________________________________________________________________

DATE                : 27/05/2021

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Filesystem Trigger Plugin for
                                        Jenkins,
                          Markdown Formatter Plugin for Jenkins,
                          Nuget Plugin for Jenkins,
                          URLTrigger Plugin for Jenkins.

=====================================================================
https://www.jenkins.io/security/advisory/2021-05-25/
_____________________________________________________________________

 Jenkins Security Advisory 2021-05-25

This advisory announces vulnerabilities in the following Jenkins
deliverables:

    Filesystem Trigger Plugin
    Markdown Formatter Plugin
    Nuget Plugin
    URLTrigger Plugin


Descriptions

XXE vulnerability in Filesystem Trigger Plugin
SECURITY-2339 / CVE-2021-21657

Filesystem Trigger Plugin 0.40 and earlier does not configure its XML
parser to prevent XML external entity (XXE) attacks.

This allows attackers with Job/Configure permission or otherwise able to
control the contents of an XML file being polled for changes to have
Jenkins parse a crafted XML document that uses external entities for
extraction of secrets from the polling Jenkins controller or agent,
server-side request forgery, or denial-of-service attacks.

Filesystem Trigger Plugin 0.41 disables external entity resolution for
its XML parser.


XXE vulnerability in Nuget Plugin
SECURITY-2340 / CVE-2021-21658

Nuget Plugin 1.0 and earlier does not configure its XML parser to
prevent XML external entity (XXE) attacks. This XML parser is used for
the "Build on NuGet updates" feature.

This allows attackers with the ability to control the contents of the
packages.config file in a workspace to have Jenkins parse a crafted XML
document that uses external entities for extraction of secrets from the
Jenkins controller or server-side request forgery.

Nuget Plugin 1.1 disables external entity resolution for its XML parser.


XXE vulnerability in URLTrigger Plugin
SECURITY-2341 / CVE-2021-21659

URLTrigger Plugin 0.48 and earlier does not configure its XML parser to
prevent XML external entity (XXE) attacks.

This allows attackers with Job/Configure permission or otherwise able to
control the contents of an URL to an XML document being examined for
changes to have Jenkins parse a crafted XML document that uses external
entities for extraction of secrets from the polling Jenkins controller
or agent, server-side request forgery, or denial-of-service attacks.

URLTrigger Plugin 0.49 disables external entity resolution for its XML
parser.


XSS vulnerability in Markdown Formatter Plugin
SECURITY-2198 / CVE-2021-21660

Markdown Formatter Plugin 0.1.0 and earlier uses a Markdown library to
parse Markdown that does not escape crafted link target URLs.

This results in a stored cross-site scripting (XSS) vulnerability
exploitable by attackers with the ability to edit any description
rendered using the configured markup formatter.

Markdown Formatter Plugin 0.2.0 uses a different Markdown library that
is not affected by this problem.


Severity

    SECURITY-2198: High
    SECURITY-2339: High
    SECURITY-2340: Medium
    SECURITY-2341: High


Affected Versions

    Filesystem Trigger Plugin up to and including 0.40
    Markdown Formatter Plugin up to and including 0.1.0
    Nuget Plugin up to and including 1.0
    URLTrigger Plugin up to and including 0.48


Fix

    Filesystem Trigger Plugin should be updated to version 0.41
    Markdown Formatter Plugin should be updated to version 0.2.0
    Nuget Plugin should be updated to version 1.1
    URLTrigger Plugin should be updated to version 0.49


These versions include fixes to the vulnerabilities described above. All
prior versions are considered to be affected by these vulnerabilities
unless otherwise indicated.


Credit

The Jenkins project would like to thank the reporters for discovering
and reporting these vulnerabilities:

    Kevin Guerroudj for SECURITY-2339, SECURITY-2340, SECURITY-2341



=========================================================
+ CERT-RENATER       |    tel : 01-53-94-20-44          +
+ 23/25 Rue Daviel   |    fax : 01-53-94-20-41          +
+ 75013 Paris        |    email:cert@support.renater.fr +
=========================================================