Jenkins Security Advisory 2020-09-23

This advisory announces vulnerabilities in the following Jenkins deliverables:

Descriptions

Sandbox bypass vulnerability in Script Security Plugin

SECURITY-2020 / CVE-2020-2279

Script Security Plugin provides a sandbox feature that allows low privileged users to define scripts, including Pipelines, that are generally safe to execute. Calls to code defined inside a sandboxed script are intercepted, and various allowlists are checked to determine whether the call is to be allowed.

In Script Security Plugin 1.74 and earlier, any calls from outside a sandboxed script to code defined inside a sandboxed script were always allowed. As sandboxed scripts can communicate their results through script return values and similar mechanisms, this could result in code defined inside of a sandboxed script to be called without sandbox protection.

This vulnerability allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

Script Security Plugin 1.75 will prevent code defined inside a sandbox from being invoked outside a sandboxed script.

In rare cases, invocations of sandboxed scripts may begin failing if the script return value or script binding include code defined in the sandbox and is further processed by the calling code. To resolve this issue, the affected values need to be converted inside the sandboxed script to a known safe type, such as String.

For compatibility with this change, the following plugins should be upgraded to the versions specified:

CSRF vulnerability in Warnings Plugin allows remote code execution

SECURITY-2042 / CVE-2020-2280

Warnings Plugin 5.0.1 and earlier does not require POST requests for a form validation method intended for testing custom warnings parsers, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to execute arbitrary code.

Warnings Plugin 5.0.2 requires POST requests for the affected form validation method.

This vulnerability was caused by an incomplete fix to SECURITY-1295.

CSRF vulnerability in Lockable Resources Plugin

SECURITY-1958 / CVE-2020-2281

Lockable Resources Plugin 2.8 and earlier does not require POST requests for several HTTP endpoints, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to reserve, unreserve, unlock, and reset resources.

Lockable Resources Plugin 2.9 requires POST requests for the affected HTTP endpoints.

Missing permission check in Implied Labels Plugin allows reconfiguring the plugin

SECURITY-2004 / CVE-2020-2282

Implied Labels Plugin 0.6 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to configure the plugin.

Implied Labels Plugin 0.7 requires Overall/Administer permission to configure the plugin.

Stored XSS vulnerability in Liquibase Runner Plugin

SECURITY-1885 / CVE-2020-2283

Liquibase Runner Plugin 1.4.5 and earlier does not escape changeset contents when showing them on the build page.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide Liquibase changesets evaluated by the plugin.

Liquibase Runner Plugin 1.4.7 no longer supports evaluating changesets.

XXE vulnerability in Liquibase Runner Plugin

SECURITY-1887 / CVE-2020-2284

Liquibase Runner Plugin 1.4.5 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers able to provide Liquibase changesets evaluated by the plugin to have Jenkins parse a crafted XML file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

Liquibase Runner Plugin 1.4.7 no longer parses Liquibase changesets.

Missing permission check in Liquibase Runner Plugin allows enumerating credentials IDs

SECURITY-2030 / CVE-2020-2285

Liquibase Runner Plugin 1.4.7 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

An enumeration of credentials IDs in Liquibase Runner Plugin 1.4.8 requires the appropriate permissions.

Severity

Affected Versions

  • Implied Labels Plugin up to and including 0.6
  • Liquibase Runner Plugin up to and including 1.4.5
  • Liquibase Runner Plugin up to and including 1.4.7
  • Lockable Resources Plugin up to and including 2.8
  • Script Security Plugin up to and including 1.74
  • Warnings Plugin up to and including 5.0.1

Fix

  • Implied Labels Plugin should be updated to version 0.7
  • Liquibase Runner Plugin should be updated to version 1.4.7
  • Liquibase Runner Plugin should be updated to version 1.4.8
  • Lockable Resources Plugin should be updated to version 2.9
  • Script Security Plugin should be updated to version 1.75
  • Warnings Plugin should be updated to version 5.0.2

These versions include fixes to the vulnerabilities described above. All prior versions are considered to be affected by these vulnerabilities unless otherwise indicated.

Credit

The Jenkins project would like to thank the reporters for discovering and reporting these vulnerabilities:

  • Daniel Beck, CloudBees, Inc. for SECURITY-1885, SECURITY-1887, SECURITY-2030
  • Devin Nusbaum, CloudBees, Inc. for SECURITY-2042
  • Pierre Beitz, CloudBees, Inc. for SECURITY-1958
  • Wadeck Follonier, CloudBees, Inc. and Daniel Beck, CloudBees, Inc. for SECURITY-2020