Jenkins Security Advisory 2024-05-02

This advisory announces vulnerabilities in the following Jenkins deliverables:

Descriptions

Multiple sandbox bypass vulnerabilities in Script Security Plugin

SECURITY-3341 / CVE-2024-34144 (crafted constructor bodies), CVE-2024-34145 (sandbox-defined classes)
Severity (CVSS): High
Affected plugin: script-security
Description:

Script Security Plugin provides a sandbox feature that allows low privileged users to define scripts, including Pipelines, that are generally safe to execute. Calls to code defined inside a sandboxed script are intercepted, and various allowlists are checked to determine whether the call is to be allowed.

Multiple sandbox bypass vulnerabilities exist in Script Security Plugin 1335.vf07d9ce377a_e and earlier:

  • Crafted constructor bodies that invoke other constructors can be used to construct any subclassable type via implicit casts.

  • Sandbox-defined Groovy classes that shadow specific non-sandbox-defined classes can be used to construct any subclassable type.

These vulnerabilities allow attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

These issues are caused by an incomplete fix of SECURITY-2824.

Script Security Plugin 1336.vf33a_a_9863911 has additional restrictions and sanity checks to ensure that super constructors cannot be constructed without being intercepted by the sandbox:

  • Calls to to other constructors using this are now intercepted by the sandbox.

  • Classes in packages that can be shadowed by Groovy-defined classes are no longer ignored by the sandbox when intercepting super constructor calls.

Missing permission check in Git server Plugin

SECURITY-3342 / CVE-2024-34146
Severity (CVSS): Medium
Affected plugin: git-server
Description:

Git server Plugin 114.v068a_c7cc2574 and earlier does not perform a permission check for read access to a Git repository over SSH.

This allows attackers with a previously configured SSH public key but lacking Overall/Read permission to access Git repositories.

Git server Plugin 117.veb_68868fa_027 requires Overall/Read permission to access Git repositories over SSH.

Token stored in plain text by Telegram Bot Plugin

SECURITY-3294 / CVE-2024-34147
Severity (CVSS): Low
Affected plugin: telegram-notifications
Description:

Telegram Bot Plugin 1.4.0 and earlier stores the Telegram Bot token unencrypted in its global configuration file jenkinsci.plugins.telegrambot.TelegramBotGlobalConfiguration.xml on the Jenkins controller as part of its configuration.

This token can be viewed by users with access to the Jenkins controller file system.

As of publication of this advisory, there is no fix. Learn why we announce this.

Security protection disabled by Subversion Partial Release Manager Plugin

SECURITY-3331 / CVE-2024-34148
Severity (CVSS): Medium
Affected plugin: svn-partial-release-mgr
Description:

Subversion Partial Release Manager Plugin 1.0.1 and earlier programmatically sets the Java system property hudson.model.ParametersAction.keepUndefinedParameters whenever a build is triggered from a release tag with the 'Svn-Partial Release Manager' SCM. Doing so disables the fix for SECURITY-170 / CVE-2016-3721.

As of publication of this advisory, there is no fix. Learn why we announce this.

Severity

Affected Versions

  • Git server Plugin up to and including 114.v068a_c7cc2574
  • Script Security Plugin up to and including 1335.vf07d9ce377a_e
  • Subversion Partial Release Manager Plugin up to and including 1.0.1
  • Telegram Bot Plugin up to and including 1.4.0

Fix

  • Git server Plugin should be updated to version 117.veb_68868fa_027
  • Script Security Plugin should be updated to version 1336.vf33a_a_9863911

These versions include fixes to the vulnerabilities described above. All prior versions are considered to be affected by these vulnerabilities unless otherwise indicated.

As of publication of this advisory, no fixes are available for the following plugins:

  • Subversion Partial Release Manager Plugin
  • Telegram Bot Plugin

Learn why we announce these issues.

Credit

The Jenkins project would like to thank the reporters for discovering and reporting these vulnerabilities:

  • Daniel Beck, CloudBees, Inc. for SECURITY-3331, SECURITY-3342
  • Devin Nusbaum, CloudBees, Inc. for SECURITY-3341
  • Surya Dev Singh Rawal , Siemens-Healthineers Pvt Ltd for SECURITY-3294