Jenkins, the popular open-source automation server, has recently announced the availability of patches to address high- and medium-severity vulnerabilities impacting several plugins. These patches are crucial for maintaining the security and integrity of Jenkins installations. Among the vulnerabilities, three high-severity cross-site request forgery (CSRF) and cross-site scripting (XSS) issues have been identified in the Folders, Flaky Test Handler, and Shortcut Job plugins.
High-severity vulnerabilities and patches
The Folders plugin, specifically versions 6.846.v23698686f0f6 and earlier, contains a high-severity vulnerability. This flaw stems from the fact that no POST requests were required for an HTTP endpoint, leading to CSRF attacks. Jenkins has addressed this issue in the latest patch.
The Flaky Test Handler plugin, versions 1.2.2 and earlier, suffers from a high-severity XSS vulnerability. The plugin fails to escape JUnit test contents when displayed in the Jenkins UI, thereby enabling attackers to execute XSS attacks. The recent patch ensures proper sanitization and mitigation of this vulnerability.
Versions 0.4 and earlier of the Shortcut Job plugin exhibit an XSS (cross-site scripting) flaw. This arises from the plugin’s failure to adequately escape the shortcut redirection URL. The vulnerability allows attackers to inject malicious code into the Jenkins UI, posing a significant security risk. The latest patch rectifies this flaw.
Furthermore, an additional high-severity XSS vulnerability has surfaced in the Docker Swarm plugin. Versions 1.11 and earlier of this plugin do not adequately sanitize values returned from Docker before they are inserted into the Docker Swarm Dashboard view. This vulnerability has been promptly addressed by Jenkins’ latest patch.
Medium-severity vulnerabilities and patches
Jenkins has also identified and addressed medium-severity vulnerabilities in various plugins, including:
1. Folders Plugin:
Apart from the high-severity vulnerability mentioned earlier, this plugin is susceptible to information disclosure, CSRF attacks, and HTML injection. Jenkins has provided patches to effectively mitigate these risks.
2. Config File Provider Plugin:
The Config File Provider plugin has vulnerabilities that may lead to credential leaks and CSRF attacks. Jenkins has released patches to address these issues, ensuring user credentials remain secure.
3. Node.js Plugin:
The Node.js plugin, if left unpatched, could result in information disclosure and CSRF attacks. The latest update resolves these vulnerabilities, safeguarding sensitive data.
4. Blue Ocean Plugin:
Another plugin affected by CSRF attacks and potential credential ID enumeration is Blue Ocean. Jenkins’ latest patches address these medium-severity vulnerabilities.
5. Fortify Plugin:
The Fortify plugin possesses vulnerabilities that could result in information disclosure and CSRF attacks. The patches offered by Jenkins effectively address these risks.
6. Delphix Plugin:
Similar to the other plugins mentioned, the Delphix plugin has medium-severity vulnerabilities that could lead to information disclosure and CSRF attacks. Jenkins’ patches ensure the plugin’s functionality remains secure.
Medium-severity vulnerabilities without patches
However, Jenkins warns that three medium-severity vulnerabilities in specific plugins have yet to receive patches. These plugins include the Maven Artifact ChoiceListProvider (Nexus), Gogs, and Favorite View plugins. These vulnerabilities may potentially expose credentials, disclose sensitive information, or facilitate CSRF attacks. Users are advised to remain vigilant and consider appropriate mitigating measures until patches become available.
Low-severity vulnerabilities and patches
Lastly, Jenkins has also addressed a low-severity vulnerability in the Tuleap Authentication plugin. The vulnerability allowed attackers to obtain a valid authentication token. This security flaw has been fixed in the latest patch, ensuring the plugin’s functionality remains secure.
Jenkins has demonstrated its commitment to proactively addressing vulnerabilities by releasing patches for high- and medium-severity security flaws in multiple plugins. However, users are urged to stay vigilant and apply the necessary patches promptly to ensure the utmost security of their Jenkins installations. Additionally, awareness of the three medium-severity vulnerabilities without patches is vital, and users should take extra precautions to mitigate potential risks. By staying proactive in addressing security concerns, the Jenkins community can continue to rely on a secure and robust automation server.