Jenkins Security Advisory 2017-07-10

This advisory originally recommended upgrading Poll SCM plugin to version 1.4. This was incorrect. Version 1.3.1 contains the fix.

This advisory announces vulnerabilities in these Jenkins plugins:

Description

Parameterized Trigger Plugin fails to check Item/Build permission

SECURITY-201 / CVE-2017-1000084

Builds in Jenkins are associated with an authentication that controls the permissions that the build has to interact with other elements in Jenkins. By default, builds run as SYSTEM and are unconstrained unless plugins implement specific additional permission checks.

Plugins like Authorize Project Plugin allow changing the authentication associated with a build.

The Parameterized Trigger Plugin did not check the build authentication it was running as and allowed triggering any other project in Jenkins.

The plugin has been adapted to now check for Item/Build permission before triggering a downstream build.

CSRF vulnerability and insufficient permission checks allow capturing credentials in Subversion Plugin

SECURITY-303 / CVE-2017-1000085

Subversion Plugin connects to a user-specified Subversion repository as part of form validation (e.g. to retrieve a list of tags).

This functionality improperly checked permissions, allowing any user with Item/Build permission (but not Item/Configure) to connect to any web server or Subversion server and send credentials with a known ID, thereby possibly capturing them.

Additionally, this functionality did not require POST requests be used, thereby allowing the above to be performed without direct access to Jenkins via Cross-Site Request Forgery attacks.

This functionality now properly checks permissions and is only available via POST.

Missing permission checks in Periodic Backup Plugin allow every user to change settings

SECURITY-335 / CVE-2017-1000086

The Periodic Backup Plugin did not perform any permission checks, allowing any user with Overall/Read access to change its settings, trigger backups, restore backups, and also delete all previous backups via log rotation.

Additionally, the plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks.

The plugin configuration now properly checks permissions and is only available via POST.

Unprivileged users with Overall/Read access are able to enumerate credential IDs in GitHub Branch Source Plugin

SECURITY-342 / CVE-2017-1000087

GitHub Branch Source provides a list of applicable credential IDs to allow users configuring a job to select the one they’d like to use.

This functionality did not check permissions, allowing any user with Overall/Read permission to get a list of valid credentials IDs. Those could be used as part of an attack to capture the credentials using another vulnerability.

An enumeration of credentials IDs in this plugin now requires the permission to have Extended Read permission (when that permission is enabled; otherwise Configure permission) to the job in whose context credentials are being accessed. If no job context exists, Overall/Administer permission is required.

SECURITY-352 / CVE-2017-1000088

The Sidebar Link plugin allows users able to configure jobs, views, and agents to add entries to the sidebar of these objects.

There was no input validation, which meant users were able to use javascript: schemes for these links, a persisted XSS vulnerability.

Now, only a set of whitelisted schemes are allowed by default: http, https, ftp, ftps, mailto, news, irc, gopher, nntp, feed, telnet, mms, rtsp, svn, tel, fax, xmpp, as well as relative links. Sidebar entries configured with prohibited schemes instead redirect to an error page in Jenkins explaining that it’s prohibited.

To add or remove from this list of schemes, provide the Java system property hudson.plugins.sidebar_link.LinkProtection.whitelistedSchemes with the complete comma-separated list of schemes to allow.

Pipeline: Build Step Plugin fails to check Item/Build permission

SECURITY-433 / CVE-2017-1000089

Builds in Jenkins are associated with an authentication that controls the permissions that the build has to interact with other elements in Jenkins. By default, builds run as SYSTEM and are unconstrained unless plugins implement specific additional permission checks.

Plugins like Authorize Project Plugin allow changing the authentication associated with a build.

The Pipeline: Build Step Plugin did not check the build authentication it was running as and allowed triggering any other project in Jenkins.

The plugin has been adapted to now check for Item/Build permission before triggering a downstream build.

CSRF vulnerability in Role-based Authorization Strategy Plugin configuration

SECURITY-516 / CVE-2017-1000090

Role-based Authorization Strategy Plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks. This allowed attackers to add administrator role to any user, or to remove the authorization configuration, preventing legitimate access to Jenkins.

This functionality is now only available via POST.

CSRF vulnerability and insufficient permission checks allow capturing credentials in GitHub Branch Source Plugin

SECURITY-527 / CVE-2017-1000091

GitHub Branch Source Plugin connects to a user-specified GitHub API URL (e.g. GitHub Enterprise) as part of form validation and completion (e.g. to verify Scan Credentials are correct).

This functionality improperly checked permissions, allowing any user with Overall/Read access to Jenkins to connect to any web server and send credentials with a known ID, thereby possibly capturing them.

Additionally, this functionality did not require POST requests be used, thereby allowing the above to be performed without direct access to Jenkins via Cross-Site Request Forgery.

This functionality now properly checks permissions and is only available via POST.

CSRF vulnerability in Git plugin allows capturing credentials

SECURITY-528 / CVE-2017-1000092

Git Plugin connects to a user-specified Git repository as part of form validation.

An attacker with no direct access to Jenkins but able to guess at a username/password credentials ID could trick a developer with job configuration permissions into following a link with a maliciously crafted Jenkins URL which would result in the Jenkins Git client sending the username and password to an attacker-controlled server.

This functionality now is only available via POST.

CSRF vulnerability in Poll SCM Plugin allowed unauthorized polling

SECURITY-529 / CVE-2017-1000093

Poll SCM Plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks. This allowed attackers to initiate polling of projects with a known name.

While Jenkins in general does not consider polling to be a protection-worthy action as it’s similar to cache invalidation, the plugin specifically adds a permission to be able to use this functionality, and this issue undermines that permission.

This functionality now is only available via POST.

Unprivileged users with Overall/Read access are able to enumerate credential IDs in Docker Commons Plugin

SECURITY-533 / CVE-2017-1000094

Docker Commons Plugin provides a list of applicable credential IDs to allow users configuring a job to select the one they’d like to use to authenticate with a Docker Registry.

This functionality did not check permissions, allowing any user with Overall/Read permission to get a list of valid credentials IDs. Those could be used as part of an attack to capture the credentials using another vulnerability.

An enumeration of credentials IDs in this plugin now requires the permission to have Extended Read permission (when that permission is enabled; otherwise Configure permission) to the job in whose context credentials are being accessed. If no job context exists, Overall/Administer permission is required.

Unsafe methods in the default whitelist in Script Security Plugin

SECURITY-538 / CVE-2017-1000095

The default whitelist included the entries:

DefaultGroovyMethods.putAt(Object, String, Object)
DefaultGroovyMethods.getAt(Object, String)

These allowed circumventing many of the access restrictions implemented in the script sandbox by using e.g. currentBuild['rawBuild'] rather than currentBuild.rawBuild.

Additionally, the following entries allowed accessing private data that would not be accessible otherwise due to script security:

groovy.json.JsonOutput.toJson(Closure)
groovy.json.JsonOutput.toJson(Object)

These have now been removed from the whitelist and added to the blacklist.

Scripts, such as Pipeline jobs, that integrate with Script Security and use these methods will now fail. Use of these methods will appear on the In-Process Script Approval page, and it warns administrators that they are unsafe to approve.

Arbitrary code execution due to incomplete sandbox protection in Pipeline: Groovy Plugin

SECURITY-551 / CVE-2017-1000096

Pipelines are subject to script security: Either the entire Pipeline needs to be approved, or it runs in a sandbox, with only whitelisted methods etc. allowed to be called.

Constructors, instance variable initializers, and instance initializers in Pipeline scripts were not subject to sandbox protection, and could therefore execute arbitrary code.

This could be exploited e.g. by regular Jenkins users with the permission to configure Pipelines in Jenkins, or by trusted committers to repositories containing Jenkinsfiles.

These language elements are now subject to sandbox protection.

This change may cause existing scripts relying on the incomplete sandbox protection to start failing, and requiring additional script approval.

The fix for this introduced a regression that results in constructors and instance initializers of classes defined in pipeline scripts no longer being able to set final fields. Static initializers are no longer able to set static final fields. The workaround is to make fields non-final.

SSH Plugin stored credentials in plain text configuration files

JENKINS-21436

The SSH Plugin stores credentials which allow jobs to access remote servers via the SSH protocol. User passwords and passphrases for encrypted SSH keys are stored in plaintext in a configuration file.

SSH Plugin now integrates with the Credentials Plugin and existing credentials are migrated.

Severity

Affected versions

  • Docker Commons Plugin up to and including version 1.7

  • Git Plugin up to and including version 3.3.1 and 2.4.0-beta-1

  • GitHub Branch Source Plugin up to and including version 2.0.7 and 2.2.0-beta-1

  • Parameterized Trigger Plugin up to and including version 2.34

  • Periodic Backup Plugin up to and including version 1.4

  • Pipeline: Build Step Plugin up to and including version 2.5

  • Pipeline: Groovy Plugin up to and including version 2.36

  • Poll SCM Plugin up to and including version 1.3

  • Role-based Authorization Strategy Plugin up to and including version 2.5.0

  • Script Security Plugin up to and including version 1.29

  • Sidebar Link Plugin up to and including version 1.8

  • SSH Plugin up to and including version 2.4

  • Subversion Plugin up to and including version 2.8

Fix

  • Docker Commons Plugin should be updated to version 1.8

  • Git Plugin should be updated to version 3.3.2 or 3.4.0-beta-2

  • GitHub Branch Source Plugin should be updated to version 2.0.8 or 2.2.0-beta-2

  • Parameterized Trigger Plugin should be updated to version 2.35

  • Periodic Backup Plugin should be updated to version 1.5

  • Pipeline: Build Step Plugin should be updated to version 2.5.1

  • Pipeline: Groovy Plugin should be updated to version 2.36.1

  • Poll SCM Plugin should be updated to version 1.3.1

  • Role-based Authorization Strategy Plugin should be updated to version 2.5.1

  • Script Security Plugin should be updated to version 1.29.1

  • Sidebar Link Plugin should be updated to version 1.9

  • SSH Plugin should be updated to version 2.5

  • Subversion Plugin should be updated to version 2.9

These versions include fixes to the vulnerabilities described above. All prior versions are affected by these vulnerabilities unless otherwise indicated.

Credit

The Jenkins project would like to thank the reporters for discovering and reporting these vulnerabilities:

  • Daniel Beck, CloudBees, Inc. for SECURITY-529

  • Jesse Glick, CloudBees, Inc. for SECURITY-303, SECURITY-342, SECURITY-527, SECURITY-528

  • Karl Shultz, CloudBees, Inc. for SECURITY-533

  • Nathan Rennie-Waldock for SECURITY-335

  • Simon St John-Green for SECURITY-551

  • Steven Christou, CloudBees, Inc. for SECURITY-201

  • Suhas Sunil Gaikwad @IamSuhasGaikwad for SECURITY-352