SB2019092603 - Multiple vulnerabilities in Project Inheritance plugin for Jenkins

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Information disclosure (CVE-ID: CVE-2019-10407)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the affected plugin displays a list of environment variables passed to a build without masking sensitive variables contributed by the Mask Passwords Plugin. A remote authenticated attacker can gain unauthorized access to sensitive information on the system and define secret environment variables (typically passwords) to be passed to builds, both globally, and for specific jobs.

2) Improper access control (CVE-ID: CVE-2019-10409)

The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due a missing permission check in the HTTP endpoint triggering project creation. A remote authenticated user with Overall/Read permission can bypass implemented security restrictions and create these projects from templates.

3) Cross-site request forgery (CVE-ID: CVE-2019-10408)

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin. A remote authenticated attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website such as trigger project generation from templates.

Remediation

Install update from vendor's website.

References

• http://www.openwall.com/lists/oss-security/2019/09/25/3
• https://jenkins.io/security/advisory/2019-09-25/#SECURITY-351
• https://jenkins.io/security/advisory/2019-09-25/#SECURITY-401