-------- Forwarded Message -------- Subject: CERT-Renater : 2023/VULN155 (Jenkins : Jenkins Security Advisory 2023-04-12) Date: Thu, 13 Apr 2023 19:30:45 +0200 From: CERT-RENATER Reply-To: certsvp@renater.fr To: renater-cert ===================================================================== CERT-Renater Note d'Information No. 2023/VULN155 _____________________________________________________________________ DATE : 13/04/2023 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running Azure Key Vault Plugin for Jenkins, Assembla merge request builder Plugin for Jenkins, Consul KV Builder Plugin for Jenkins, Fogbugz Plugin for Jenkins, Image Tag Parameter Plugin for Jenkins, Kubernetes Plugin for Jenkins, Lucene-Search Plugin for Jenkins, NeuVector Vulnerability Scanner Plugin for Jenkins, Quay.io trigger Plugin for Jenkins, Report Portal Plugin for Jenkins, Thycotic DevOps Secrets Vault Plugin for Jenkins, Thycotic Secret Server Plugin for Jenkins, TurboScript Plugin for Jenkins, WSO2 Oauth Plugin for Jenkins. ===================================================================== https://www.jenkins.io/security/advisory/2023-04-12/ _____________________________________________________________________ Jenkins Security Advisory 2023-04-12 This advisory announces vulnerabilities in the following Jenkins deliverables: Assembla merge request builder Plugin Azure Key Vault Plugin Consul KV Builder Plugin Fogbugz Plugin Image Tag Parameter Plugin Kubernetes Plugin Lucene-Search Plugin NeuVector Vulnerability Scanner Plugin Quay.io trigger Plugin Report Portal Plugin Thycotic DevOps Secrets Vault Plugin Thycotic Secret Server Plugin TurboScript Plugin WSO2 Oauth Plugin Descriptions Improper masking of credentials in multiple plugins SECURITY-3075 / CVE-2023-30513 (Kubernetes), CVE-2023-30514 (Azure Key Vault), CVE-2023-30515 (Thycotic DevOps Secrets Vault) Severity (CVSS): Medium Affected plugins: kubernetes , azure-keyvault , thycotic-devops-secrets-vault Description: Multiple plugins do not properly mask (i.e., replace with asterisks) credentials printed in the build log from Pipeline steps like sh and bat, when both of the following conditions are met: The credentials are printed in build steps executing on an agent (typically inside a node block). Push mode for durable task logging is enabled. This is a hidden option in Pipeline: Nodes and Processes that can be enabled through the Java system property org.jenkinsci.plugins.workflow.steps.durable_task.DurableTaskStep.USE_WATCHING. It is also automatically enabled by some plugins, e.g., OpenTelemetry and Pipeline Logging over CloudWatch. The following plugins are affected by this vulnerability: Kubernetes 3909.v1f2c633e8590 and earlier (SECURITY-3079 / CVE-2023-30513) Azure Key Vault 187.va_cd5fecd198a_ and earlier (SECURITY-3051 / CVE-2023-30514) Thycotic DevOps Secrets Vault 1.0.0 (SECURITY-3078 / CVE-2023-30515) The following plugins have been updated to properly mask credentials in the build log when push mode for durable task logging is enabled: Kubernetes 3910.ve59cec5e33ea_ (SECURITY-3079 / CVE-2023-30513) Azure Key Vault 188.vf46b_7fa_846a_1 (SECURITY-3051 / CVE-2023-30514) As of publication of this advisory, there is no fix available for the following plugin: Thycotic DevOps Secrets Vault 1.0.0 (SECURITY-3078 / CVE-2023-30515) An improvement in Credentials Binding 523.525.vb_72269281873 implements a workaround that applies build log masking even in affected plugins. This workaround is temporary and potentially incomplete, so it is still recommended that affected plugins be updated to resolve this issue. Disabled SSL/TLS certificate validation for existing configurations in Image Tag Parameter Plugin SECURITY-2840 / CVE-2023-30516 Severity (CVSS): Medium Affected plugin: image-tag-parameter Description: Image Tag Parameter Plugin 2.0 improperly introduces an option to opt out of SSL/TLS certificate validation when connecting to Docker registries. Job configurations using Image Tag Parameters that were created before 2.0 will have SSL/TLS certificate validation disabled by default. As of publication of this advisory, there is no fix. Learn why we announce this. SSL/TLS certificate validation unconditionally disabled by NeuVector Vulnerability Scanner Plugin SECURITY-2841 / CVE-2023-30517 Severity (CVSS): Medium Affected plugin: neuvector-vulnerability-scanner Description: NeuVector Vulnerability Scanner Plugin 1.22 and earlier unconditionally disables SSL/TLS certificate and hostname validation when connecting to a configured NeuVector Vulnerability Scanner server. As of publication of this advisory, there is no fix. Learn why we announce this. Missing permission check in Thycotic Secret Server Plugin allows enumerating credentials IDs SECURITY-2837 / CVE-2023-30518 Severity (CVSS): Medium Affected plugin: thycotic-secret-server Description: Thycotic Secret Server Plugin 1.0.2 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability. As of publication of this advisory, there is no fix. Learn why we announce this. Lack of authentication mechanism in Quay.io trigger Plugin webhook SECURITY-2849 / CVE-2023-30519 Severity (CVSS): Medium Affected plugin: quayio-trigger Description: Quay.io trigger Plugin provides a webhook endpoint at /quayio-webhook/ that can be used to trigger builds of jobs configured to use a specified repository. In Quay.io trigger Plugin 0.1 and earlier, this endpoint can be accessed without authentication. This allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository. As of publication of this advisory, there is no fix. Learn why we announce this. Stored XSS vulnerability in Quay.io trigger Plugin SECURITY-2850 / CVE-2023-30520 Severity (CVSS): High Affected plugin: quayio-trigger Description: Quay.io trigger Plugin 0.1 and earlier does not limit URL schemes for repository homepage URLs submitted via Quay.io trigger webhooks. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to submit crafted Quay.io trigger webhook payloads. As of publication of this advisory, there is no fix. Learn why we announce this. Lack of authentication mechanism in Assembla merge request builder Plugin webhook SECURITY-2872 / CVE-2023-30521 Severity (CVSS): Medium Affected plugin: assembla-merge-request-builder Description: Assembla merge request builder Plugin provides a webhook endpoint at /assembla-webhook/ that can be used to trigger builds of jobs configured to use a specified repository. In Assembla merge request builder Plugin 1.1.13 and earlier, this endpoint can be accessed without authentication. This allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository. As of publication of this advisory, there is no fix. Learn why we announce this. Lack of authentication mechanism in Fogbugz Plugin webhook SECURITY-2873 / CVE-2023-30522 Severity (CVSS): Medium Affected plugin: fogbugz Description: Fogbugz Plugin provides a webhook endpoint at /fbTrigger/ that can be used to trigger builds of any jobs. In Fogbugz Plugin 2.2.17 and earlier, this endpoint can be accessed by attackers with Item/Read permission, allowing them to trigger builds of jobs specified in a jobname request parameter. As of publication of this advisory, there is no fix. Learn why we announce this. Tokens stored and displayed in plain text by Report Portal Plugin SECURITY-2945 / CVE-2023-30523 (storage), CVE-2023-30524 (masking) Severity (CVSS): Medium Affected plugin: reportportal Description: Report Portal Plugin 0.5 and earlier stores ReportPortal access tokens unencrypted in job config.xml files on the Jenkins controller as part of its configuration. These tokens can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. Additionally, the configuration form does not mask these tokens, increasing the potential for attackers to observe and capture them. As of publication of this advisory, there is no fix. Learn why we announce this. CSRF vulnerability and missing permission check in Report Portal Plugin SECURITY-2950 / CVE-2023-30525 (CSRF), CVE-2023-30526 (missing permission check) Severity (CVSS): Medium Affected plugin: reportportal Description: Report Portal Plugin 0.5 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified bearer token authentication. Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability. As of publication of this advisory, there is no fix. Learn why we *announce this. Client secret stored and displayed in plain text by WSO2 Oauth Plugin SECURITY-2992 / CVE-2023-30527 (storage), CVE-2023-30528 (masking) Severity (CVSS): Low Affected plugin: wso2id-oauth Description: WSO2 Oauth Plugin 1.0 and earlier stores the WSO2 Oauth client secret unencrypted in the global config.xml file on the Jenkins controller as part of its configuration. This client secret can be viewed by users with access to the Jenkins controller file system. Additionally, the global configuration form does not mask the WSO2 Oauth client secret, increasing the potential for attackers to observe and capture it. As of publication of this advisory, there is no fix. Learn why we announce this. CSRF vulnerability in Lucene-Search Plugin SECURITY-3013 / CVE-2023-30529 Severity (CVSS): Medium Affected plugin: lucene-search Description: Lucene-Search Plugin 387.v938a_ecb_f7fe9 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability. This vulnerability allows attackers to reindex the database. As of publication of this advisory, there is no fix. Learn why we announce this. Token stored and displayed in plain text by Consul KV Builder Plugin SECURITY-2944 / CVE-2023-30530 (storage), CVE-2023-30531 (masking) Severity (CVSS): Medium Affected plugin: consul-kv-builder Description: Consul KV Builder Plugin 2.0.13 and earlier stores the HashiCorp Consul ACL Token unencrypted in its global configuration file org.jenkinsci.plugins.consulkv.GlobalConsulConfig.xml on the Jenkins controller as part of its configuration. This token can be viewed by users with access to the Jenkins controller file system. Additionally, the global configuration form does not mask the token, increasing the potential for attackers to observe and capture it. As of publication of this advisory, there is no fix. Learn why we announce this. Lack of authentication mechanism in TurboScript Plugin webhook SECURITY-2851 / CVE-2023-30532 Severity (CVSS): Medium Affected plugin: spoonscript Description: TurboScript Plugin provides a webhook endpoint at /turbo-webhook/ that can be used to trigger builds of jobs configured to use a specified repository. In TurboScript Plugin 1.3 and earlier, this endpoint can be accessed by attackers with Item/Read permission to trigger builds of jobs corresponding to the attacker-specified repository. As of publication of this advisory, there is no fix. Learn why we announce this. Severity SECURITY-2837: Medium SECURITY-2840: Medium SECURITY-2841: Medium SECURITY-2849: Medium SECURITY-2850: High SECURITY-2851: Medium SECURITY-2872: Medium SECURITY-2873: Medium SECURITY-2944: Medium SECURITY-2945: Medium SECURITY-2950: Medium SECURITY-2992: Low SECURITY-3013: Medium SECURITY-3075: Medium Affected Versions Assembla merge request builder Plugin up to and including 1.1.13 Azure Key Vault Plugin up to and including 187.va_cd5fecd198a_ Consul KV Builder Plugin up to and including 2.0.13 Fogbugz Plugin up to and including 2.2.17 Image Tag Parameter Plugin up to and including 2.0 Kubernetes Plugin up to and including 3909.v1f2c633e8590 Lucene-Search Plugin up to and including 387.v938a_ecb_f7fe9 NeuVector Vulnerability Scanner Plugin up to and including 1.22 Quay.io trigger Plugin up to and including 0.1 Report Portal Plugin up to and including 0.5 Thycotic DevOps Secrets Vault Plugin up to and including 1.0.0 Thycotic Secret Server Plugin up to and including 1.0.2 TurboScript Plugin up to and including 1.3 WSO2 Oauth Plugin up to and including 1.0 Fix Azure Key Vault Plugin should be updated to version 188.vf46b_7fa_846a_1 Kubernetes Plugin should be updated to version 3910.ve59cec5e33ea_ These versions include fixes to the vulnerabilities described above. All prior versions are considered to be affected by these vulnerabilities unless otherwise indicated. As of publication of this advisory, no fixes are available for the following plugins: Assembla merge request builder Plugin Consul KV Builder Plugin Fogbugz Plugin Image Tag Parameter Plugin Lucene-Search Plugin NeuVector Vulnerability Scanner Plugin Quay.io trigger Plugin Report Portal Plugin Thycotic DevOps Secrets Vault Plugin Thycotic Secret Server Plugin TurboScript Plugin WSO2 Oauth Plugin Learn why we announce these issues. Credit The Jenkins project would like to thank the reporters for discovering and reporting these vulnerabilities: CC Bomber, Kitri BoB for SECURITY-2944, SECURITY-2945 Daniel Beck, CloudBees, Inc. for SECURITY-2837, SECURITY-2840, SECURITY-3013 Kevin Guerroudj, CloudBees, Inc. for SECURITY-2849, SECURITY-2850, SECURITY-2851, SECURITY-2992 Kevin Guerroudj, CloudBees, Inc. and Yaroslav Afenkin, CloudBees, Inc. for SECURITY-2873 Pavel Nakonechnyi, Netcetera AG for SECURITY-2841 Tim Jacomb for SECURITY-3075 Yaroslav Afenkin, CloudBees, Inc. for SECURITY-2950 Yaroslav Afenkin, CloudBees, Inc. and Kevin Guerroudj, CloudBees, Inc. for SECURITY-2872 ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + ========================================================= --------------Gl9VrS2uXM43Tqn0pxZYBjfu


-------- Forwarded Message --------
Subject: CERT-Renater : 2023/VULN155 (Jenkins : Jenkins Security Advisory 2023-04-12)
Date: Thu, 13 Apr 2023 19:30:45 +0200
From: CERT-RENATER <certsvp@renater.fr>
Reply-To: certsvp@renater.fr
To: renater-cert <renater-cert@listes.renater.fr>


=====================================================================

CERT-Renater

Note d'Information No. 2023/VULN155

_____________________________________________________________________

DATE : 13/04/2023

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Azure Key Vault Plugin for Jenkins,
Assembla merge request builder Plugin for Jenkins,
Consul KV Builder Plugin for Jenkins,
Fogbugz Plugin for Jenkins,
Image Tag Parameter Plugin for Jenkins,
Kubernetes Plugin for Jenkins,
Lucene-Search Plugin for Jenkins,
NeuVector Vulnerability Scanner Plugin for Jenkins,
Quay.io trigger Plugin for Jenkins,
Report Portal Plugin for Jenkins,
Thycotic DevOps Secrets Vault Plugin for Jenkins,
Thycotic Secret Server Plugin for Jenkins,
TurboScript Plugin for Jenkins,
WSO2 Oauth Plugin for Jenkins.

=====================================================================
https://www.jenkins.io/security/advisory/2023-04-12/
_____________________________________________________________________

Jenkins Security Advisory 2023-04-12

This advisory announces vulnerabilities in the following Jenkins
deliverables:

Assembla merge request builder Plugin
Azure Key Vault Plugin
Consul KV Builder Plugin
Fogbugz Plugin
Image Tag Parameter Plugin
Kubernetes Plugin
Lucene-Search Plugin
NeuVector Vulnerability Scanner Plugin
Quay.io trigger Plugin
Report Portal Plugin
Thycotic DevOps Secrets Vault Plugin
Thycotic Secret Server Plugin
TurboScript Plugin
WSO2 Oauth Plugin


Descriptions

Improper masking of credentials in multiple plugins
SECURITY-3075 / CVE-2023-30513 (Kubernetes), CVE-2023-30514 (Azure Key Vault),
CVE-2023-30515 (Thycotic DevOps Secrets Vault)

Severity (CVSS): Medium
Affected plugins: kubernetes , azure-keyvault ,
thycotic-devops-secrets-vault

Description:

Multiple plugins do not properly mask (i.e., replace with asterisks)
credentials printed in the build log from Pipeline steps like sh and
bat, when both of the following conditions are met:

The credentials are printed in build steps executing on an agent
(typically inside a node block).

Push mode for durable task logging is enabled. This is a hidden
option in Pipeline: Nodes and Processes that can be enabled through
the Java system property
org.jenkinsci.plugins.workflow.steps.durable_task.DurableTaskStep.USE_WATCHING.
It is also automatically enabled by some plugins, e.g., OpenTelemetry
and Pipeline Logging over CloudWatch.

The following plugins are affected by this vulnerability:

Kubernetes 3909.v1f2c633e8590 and earlier (SECURITY-3079 /
CVE-2023-30513)

Azure Key Vault 187.va_cd5fecd198a_ and earlier (SECURITY-3051 /
CVE-2023-30514)

Thycotic DevOps Secrets Vault 1.0.0 (SECURITY-3078 /
CVE-2023-30515)

The following plugins have been updated to properly mask credentials
in the build log when push mode for durable task logging is enabled:

Kubernetes 3910.ve59cec5e33ea_ (SECURITY-3079 / CVE-2023-30513)

Azure Key Vault 188.vf46b_7fa_846a_1 (SECURITY-3051 /
CVE-2023-30514)

As of publication of this advisory, there is no fix available for
the following plugin:

Thycotic DevOps Secrets Vault 1.0.0 (SECURITY-3078 /
CVE-2023-30515)

An improvement in Credentials Binding 523.525.vb_72269281873
implements a workaround that applies build log masking even in
affected plugins. This workaround is temporary and potentially
incomplete, so it is still recommended that affected plugins be
updated to resolve this issue.

Disabled SSL/TLS certificate validation for existing configurations
in Image Tag Parameter Plugin
SECURITY-2840 / CVE-2023-30516
Severity (CVSS): Medium
Affected plugin: image-tag-parameter

Description:

Image Tag Parameter Plugin 2.0 improperly introduces an option to
opt out of SSL/TLS certificate validation when connecting to Docker
registries.

Job configurations using Image Tag Parameters that were created
before 2.0 will have SSL/TLS certificate validation disabled by
default.

As of publication of this advisory, there is no fix. Learn why we
announce this.


SSL/TLS certificate validation unconditionally disabled by NeuVector
Vulnerability Scanner Plugin
SECURITY-2841 / CVE-2023-30517
Severity (CVSS): Medium
Affected plugin: neuvector-vulnerability-scanner

Description:

NeuVector Vulnerability Scanner Plugin 1.22 and earlier
unconditionally disables SSL/TLS certificate and hostname validation
when connecting to a configured NeuVector Vulnerability Scanner
server.

As of publication of this advisory, there is no fix. Learn why we
announce this.


Missing permission check in Thycotic Secret Server Plugin allows
enumerating credentials IDs
SECURITY-2837 / CVE-2023-30518
Severity (CVSS): Medium
Affected plugin: thycotic-secret-server

Description:

Thycotic Secret Server Plugin 1.0.2 and earlier does not perform a
permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to enumerate
credentials IDs of credentials stored in Jenkins. Those can be
used as part of an attack to capture the credentials using another
vulnerability.

As of publication of this advisory, there is no fix. Learn why we
announce this.


Lack of authentication mechanism in Quay.io trigger Plugin webhook
SECURITY-2849 / CVE-2023-30519
Severity (CVSS): Medium
Affected plugin: quayio-trigger

Description:

Quay.io trigger Plugin provides a webhook endpoint at /quayio-webhook/
that can be used to trigger builds of jobs configured to use a specified
repository.

In Quay.io trigger Plugin 0.1 and earlier, this endpoint can be
accessed without authentication.

This allows unauthenticated attackers to trigger builds of jobs
corresponding to the attacker-specified repository.

As of publication of this advisory, there is no fix. Learn why we
announce this.


Stored XSS vulnerability in Quay.io trigger Plugin
SECURITY-2850 / CVE-2023-30520
Severity (CVSS): High
Affected plugin: quayio-trigger

Description:

Quay.io trigger Plugin 0.1 and earlier does not limit URL schemes for
repository homepage URLs submitted via Quay.io trigger webhooks.

This results in a stored cross-site scripting (XSS) vulnerability
exploitable by attackers able to submit crafted Quay.io trigger
webhook payloads.

As of publication of this advisory, there is no fix. Learn why we
announce this.


Lack of authentication mechanism in Assembla merge request builder
Plugin webhook
SECURITY-2872 / CVE-2023-30521
Severity (CVSS): Medium
Affected plugin: assembla-merge-request-builder

Description:

Assembla merge request builder Plugin provides a webhook endpoint at
/assembla-webhook/ that can be used to trigger builds of jobs configured
to use a specified repository.

In Assembla merge request builder Plugin 1.1.13 and earlier, this
endpoint can be accessed without authentication.

This allows unauthenticated attackers to trigger builds of jobs
corresponding to the attacker-specified repository.

As of publication of this advisory, there is no fix. Learn why we
announce this.


Lack of authentication mechanism in Fogbugz Plugin webhook
SECURITY-2873 / CVE-2023-30522
Severity (CVSS): Medium
Affected plugin: fogbugz

Description:

Fogbugz Plugin provides a webhook endpoint at /fbTrigger/ that
can be used to trigger builds of any jobs.

In Fogbugz Plugin 2.2.17 and earlier, this endpoint can be
accessed by attackers with Item/Read permission, allowing them
to trigger builds of jobs specified in a jobname request parameter.

As of publication of this advisory, there is no fix. Learn why we
announce this.


Tokens stored and displayed in plain text by Report Portal Plugin
SECURITY-2945 / CVE-2023-30523 (storage), CVE-2023-30524 (masking)
Severity (CVSS): Medium
Affected plugin: reportportal

Description:

Report Portal Plugin 0.5 and earlier stores ReportPortal access
tokens unencrypted in job config.xml files on the Jenkins controller
as part of its configuration.

These tokens can be viewed by users with Item/Extended Read permission
or access to the Jenkins controller file system.

Additionally, the configuration form does not mask these tokens,
increasing the potential for attackers to observe and capture them.

As of publication of this advisory, there is no fix. Learn why we
announce this.


CSRF vulnerability and missing permission check in Report Portal
Plugin
SECURITY-2950 / CVE-2023-30525 (CSRF), CVE-2023-30526 (missing
permission check)
Severity (CVSS): Medium
Affected plugin: reportportal

Description:

Report Portal Plugin 0.5 and earlier does not perform a permission
check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an
attacker-specified URL using attacker-specified bearer token
authentication.

Additionally, this form validation method does not require POST
requests, resulting in a cross-site request forgery (CSRF)
vulnerability.

As of publication of this advisory, there is no fix. Learn why we
*announce this.


Client secret stored and displayed in plain text by WSO2 Oauth
Plugin
SECURITY-2992 / CVE-2023-30527 (storage), CVE-2023-30528 (masking)
Severity (CVSS): Low
Affected plugin: wso2id-oauth

Description:

WSO2 Oauth Plugin 1.0 and earlier stores the WSO2 Oauth client
secret unencrypted in the global config.xml file on the Jenkins
controller as part of its configuration.

This client secret can be viewed by users with access to the Jenkins
controller file system.

Additionally, the global configuration form does not mask the WSO2
Oauth client secret, increasing the potential for attackers to
observe and capture it.

As of publication of this advisory, there is no fix. Learn why we
announce this.


CSRF vulnerability in Lucene-Search Plugin
SECURITY-3013 / CVE-2023-30529
Severity (CVSS): Medium
Affected plugin: lucene-search
Description:

Lucene-Search Plugin 387.v938a_ecb_f7fe9 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to reindex the database.

As of publication of this advisory, there is no fix. Learn why we
announce this.


Token stored and displayed in plain text by Consul KV Builder Plugin
SECURITY-2944 / CVE-2023-30530 (storage), CVE-2023-30531 (masking)
Severity (CVSS): Medium
Affected plugin: consul-kv-builder

Description:

Consul KV Builder Plugin 2.0.13 and earlier stores the HashiCorp
Consul ACL Token unencrypted in its global configuration file
org.jenkinsci.plugins.consulkv.GlobalConsulConfig.xml on the Jenkins
controller as part of its configuration.

This token can be viewed by users with access to the Jenkins controller
file system.

Additionally, the global configuration form does not mask the token,
increasing the potential for attackers to observe and capture it.

As of publication of this advisory, there is no fix. Learn why we
announce this.


Lack of authentication mechanism in TurboScript Plugin webhook
SECURITY-2851 / CVE-2023-30532
Severity (CVSS): Medium
Affected plugin: spoonscript

Description:

TurboScript Plugin provides a webhook endpoint at /turbo-webhook/
that can be used to trigger builds of jobs configured to use a
specified repository.

In TurboScript Plugin 1.3 and earlier, this endpoint can be accessed
by attackers with Item/Read permission to trigger builds of jobs
corresponding to the attacker-specified repository.

As of publication of this advisory, there is no fix. Learn why we
announce this.


Severity

SECURITY-2837: Medium
SECURITY-2840: Medium
SECURITY-2841: Medium
SECURITY-2849: Medium
SECURITY-2850: High
SECURITY-2851: Medium
SECURITY-2872: Medium
SECURITY-2873: Medium
SECURITY-2944: Medium
SECURITY-2945: Medium
SECURITY-2950: Medium
SECURITY-2992: Low
SECURITY-3013: Medium
SECURITY-3075: Medium

Affected Versions

Assembla merge request builder Plugin up to and including 1.1.13
Azure Key Vault Plugin up to and including 187.va_cd5fecd198a_
Consul KV Builder Plugin up to and including 2.0.13
Fogbugz Plugin up to and including 2.2.17
Image Tag Parameter Plugin up to and including 2.0
Kubernetes Plugin up to and including 3909.v1f2c633e8590
Lucene-Search Plugin up to and including 387.v938a_ecb_f7fe9
NeuVector Vulnerability Scanner Plugin up to and including 1.22
Quay.io trigger Plugin up to and including 0.1
Report Portal Plugin up to and including 0.5
Thycotic DevOps Secrets Vault Plugin up to and including 1.0.0
Thycotic Secret Server Plugin up to and including 1.0.2
TurboScript Plugin up to and including 1.3
WSO2 Oauth Plugin up to and including 1.0

Fix

Azure Key Vault Plugin should be updated to version
188.vf46b_7fa_846a_1
Kubernetes Plugin should be updated to version
3910.ve59cec5e33ea_

These versions include fixes to the vulnerabilities described
above. All prior versions are considered to be affected by
these vulnerabilities unless otherwise indicated.

As of publication of this advisory, no fixes are available for
the following plugins:

Assembla merge request builder Plugin
Consul KV Builder Plugin
Fogbugz Plugin
Image Tag Parameter Plugin
Lucene-Search Plugin
NeuVector Vulnerability Scanner Plugin
Quay.io trigger Plugin
Report Portal Plugin
Thycotic DevOps Secrets Vault Plugin
Thycotic Secret Server Plugin
TurboScript Plugin
WSO2 Oauth Plugin

Learn why we announce these issues.


Credit

The Jenkins project would like to thank the reporters for
discovering and reporting these vulnerabilities:

CC Bomber, Kitri BoB for SECURITY-2944, SECURITY-2945
Daniel Beck, CloudBees, Inc. for SECURITY-2837,
SECURITY-2840, SECURITY-3013
Kevin Guerroudj, CloudBees, Inc. for SECURITY-2849,
SECURITY-2850, SECURITY-2851, SECURITY-2992
Kevin Guerroudj, CloudBees, Inc. and Yaroslav Afenkin,
CloudBees, Inc. for SECURITY-2873
Pavel Nakonechnyi, Netcetera AG for SECURITY-2841
Tim Jacomb for SECURITY-3075
Yaroslav Afenkin, CloudBees, Inc. for SECURITY-2950
Yaroslav Afenkin, CloudBees, Inc. and Kevin Guerroudj,
CloudBees, Inc. for SECURITY-2872


=========================================================
+ CERT-RENATER | tel : 01-53-94-20-44 +
+ 23/25 Rue Daviel | fax : 01-53-94-20-41 +
+ 75013 Paris | email:cert@support.renater.fr +
=========================================================
--------------Gl9VrS2uXM43Tqn0pxZYBjfu--