CloudBees Security Advisory 2019-11-21

This advisory announces vulnerabilities in Jenkins, CloudBees Jenkins Distribution, CloudBees Jenkins Platform and CloudBees Core.

Sandbox bypass vulnerability in Script Security Plugin 

SECURITY-1658 / CVE-2019-16538

Sandbox protection in Script Security Plugin could be circumvented through closure default parameter expressions.

This allowed attackers able to specify and run sandboxed scripts to execute arbitrary code in the context of the Jenkins master JVM.

These expressions are now subject to sandbox protection.

Support Core Plugin allowed users with Overall/Read permission to delete arbitrary files 

SECURITY-1634 / CVE-2019-16539 (permission check), CVE-2019-16540 (path traversal)

Support Core Plugin did not validate the paths submitted for the “Delete Support Bundles” feature. This allowed users to delete arbitrary files on the Jenkins master file system accessible to the OS user account running Jenkins.

Additionally, this endpoint did not perform a permission check, allowing users with Overall/Read permission to delete support bundles, and any arbitrary other file, with a known name/path.

Support Core Plugin now only allows the deletion of support bundles and related files listed on the UI through this feature. It also ensures that only users with “Download Bundle” permission are able to delete support bundles.

Folder-scoped Jira sites in JIRA Plugin were able to access System-scoped credentials 

SECURITY-1106 / CVE-2019-16541

JIRA Plugin allows the definition of per-folder Jira sites.

The credentials lookup for this feature did not set the appropriate context, allowing the use of System-scoped credentials otherwise reserved for use in the global configuration. This allowed users with Item/Configure permission on the folder to access credentials they’re not entitled to, and potentially capture them.

JIRA Plugin now defines the appopriate folder context for credential lookup. As a side effect, existing per-folder Jira sites may lose access to already configured System-scoped credentials, as if no credential was specified in the first place.

Anchore Container Image Scanner Plugin stored credentials in plain text 

SECURITY-1539 / CVE-2019-16542

Anchore Container Image Scanner Plugin stored an Anchore.io service password unencrypted in job config.xml files as part of its configuration. This credential could be viewed by users with Extended Read permission or access to the master file system.

As the affected functionality has been deprecated, and the affected Anchore.io service has been shut down in late 2018, the affected feature has been removed. The password will be removed from the job configuration once it is saved again.

Spira Importer Plugin stored credentials in plain text 

SECURITY-1554 / CVE-2019-16543

Spira Importer Plugin stored a credential unencrypted in its global configuration file com.inflectra.spiratest.plugins.SpiraBuilder.xml on the Jenkins master. This credential could be viewed by users with access to the master file system.

Spira Importer Plugin now stores this credential encrypted once its configuration is saved again.

Google Compute Engine Plugin did not verify SSH host keys 

SECURITY-1584 / CVE-2019-16546

Google Compute Engine Plugin did not use SSH host key verification when connecting to VMs launched by the plugin. This lack of verification could be abused by a MitM attacker to intercept these connections to attacker-specified build agents without warning.

Google Compute Engine Plugin now verifies SSH host keys before executing any commands on agents.

Google Compute Engine Plugin disclosed environment information to users with Overall/Read permission 

SECURITY-1585 / CVE-2019-16547

Google Compute Engine Plugin did not verify permissions on multiple auto-complete API endpoints. This allowed users with Overall/Read permissions to view various metadata about the running cloud environment.

Google Compute Engine Plugin now requires the appropriate Job/Configure permission to view these metadata.

CSRF vulnerability in Google Compute Engine Plugin allowed provisioning agents 

SECURITY-1586 / CVE-2019-16548

Google Compute Engine Plugin did not require POST requests on an API endpoint. This CSRF vulnerability allowed attackers to provision new agents.

Google Compute Engine Plugin now requires POST requests for this API endpoint.

QMetry for JIRA - Test Management Plugin stored credentials in plain text 

SECURITY-727 (1) / CVE-2019-16544

QMetry for JIRA - Test Management Plugin stored credentials unencrypted in job config.xml files on the Jenkins master as part of its post-build step configuration. This credential could be viewed by users with Extended Read permission or access to the master file system.

QMetry for JIRA - Test Management Plugin now stores these credentials encrypted once the job configuration is saved again.

QMetry for JIRA - Test Management Plugin shows plain text password in configuration form 

SECURITY-727 (2) / CVE-2019-16545

QMetry for JIRA - Test Management Plugin stores a credential as part of its post-build step configuration.

While the password is stored encrypted on disk since QMetry for JIRA - Test Management Plugin 1.13, it is transmitted in plain text as part of the configuration form. This can result in exposure of the password through browser extensions, cross-site scripting vulnerabilities, and similar situations.

As of publication of this advisory, there is no fix.

Severity: 
Fix: 
  • CloudBees Traditional Platforms should be upgraded 2.190.3.2 rev2
  • CloudBees Cloud Platforms should be upgraded 2.190.3.2 rev2
  • CloudBees Jenkins Enterprise should be upgraded the Managed Masters and Operations Center to 2.190.3.2 rev2
  • CloudBees Jenkins Platform (rolling train, CJP Operations Center and CJP Client Master (2.x.y.z) should be upgraded to version 2.190.3.2 rev2
  • CloudBees Jenkins Platform (fixed train, CJP Operations Center and CJP Client Master (2.164.x.0.z) should be upgraded to version 2.164.32.0.1 rev3
  • CloudBees Jenkins Distribution should be upgraded to version 2.190.3.2 rev2

Plugin Fixes:

  • Google Compute Engine Plugin up to and including 4.1.1
  • Anchore Container Image Scanner Plugin up to and including 1.0.19
  • QMetry for JIRA - Test Management Plugin up to and including 1.12
  • QMetry for JIRA - Test Management Plugin up to and including 1.13
  • Spira Importer Plugin up to and including 3.2.2