Detections
Analytics

Jenkins plugins Multiple Vulnerabilities (2024-01-24)

high Nessus Plugin ID 189462

Language:

Synopsis

An application running on a remote web server host is affected by multiple vulnerabilities

Description

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities:

 - Jenkins Git server Plugin 99.va_0826a_b_cdfa_d and earlier does not disable a feature of its command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing attackers with Overall/Read permission to read content from arbitrary files on the Jenkins controller file system. (CVE-2024-23899)

 - Jenkins Matrix Project Plugin 822.v01b_8c85d16d2 and earlier does not sanitize user-defined axis names of multi-configuration projects, allowing attackers with Item/Configure permission to create or replace any config.xml files on the Jenkins controller file system with content not controllable by the attackers.
 (CVE-2024-23900)

 - Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier unconditionally discovers projects that are shared with the configured owner group, allowing attackers to configure and share a project, resulting in a crafted Pipeline being built by Jenkins during the next scan of the group. (CVE-2024-23901)

 - A cross-site request forgery (CSRF) vulnerability in Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier allows attackers to connect to an attacker-specified URL. (CVE-2024-23902)

 - Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook token. (CVE-2024-23903)

 - Qualys Jenkins Plugin for Policy Compliance prior to version and including 1.0.5 was identified to be affected by a security flaw, which was missing a permission check while performing a connectivity check to Qualys Cloud Services. This allowed any user with login access and access to configure or edit jobs to utilize the plugin to configure a potential rouge endpoint via which it was possible to control response for certain request which could be injected with XSS payloads leading to XSS while processing the response data (CVE-2023-6148)

 - Qualys Jenkins Plugin for Policy Compliance prior to version and including 1.0.5 was identified to be affected by a security flaw, which was missing a permission check while performing a connectivity check to Qualys Cloud Services. This allowed any user with login access to configure or edit jobs to utilize the plugin and configure potential a rouge endpoint via which it was possible to control response for certain request which could be injected with XXE payloads leading to XXE while processing the response data (CVE-2023-6147)

 - Jenkins Red Hat Dependency Analytics Plugin 0.7.1 and earlier programmatically disables Content-Security- Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download. (CVE-2024-23905)

 - Jenkins Log Command Plugin 1.0.2 and earlier does not disable a feature of its command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read content from arbitrary files on the Jenkins controller file system.
 (CVE-2024-23904)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update Jenkins plugins to the following versions:
 - Git server Plugin to version 99.101.v720e86326c09 or later
 - GitLab Branch Source Plugin to version 688.v5fa_356ee8520 or later
 - Log Command Plugin: See vendor advisory
 - Matrix Project Plugin to version 822.824.v14451b_c0fd42 or later
 - Qualys Policy Compliance Scanning Connector Plugin to version 1.0.6 or later
 - Red Hat Dependency Analytics Plugin to version 0.9.0 or later

See vendor advisory for more details.

See Also

https://jenkins.io/security/advisory/2024-01-24

Plugin Details

Severity: High

ID: 189462

File Name: jenkins_security_advisory_2024-01-24_plugins.nasl

Version: 1.3

Type: combined

Agent: windows, macosx, unix

Family: CGI abuses

Published: 1/24/2024

Updated: 10/3/2024

Configuration: Enable thorough checks

Supported Sensors: Nessus Agent, Nessus

Enable CGI Scanning: true

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2024-23904

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:jenkins:jenkins, cpe:/a:cloudbees:jenkins

Required KB Items: installed_sw/Jenkins

Exploit Ease: No known exploits are available

Patch Publication Date: 1/24/2024

Vulnerability Publication Date: 1/9/2024

Reference Information

CVE: CVE-2023-6147, CVE-2023-6148, CVE-2024-23899, CVE-2024-23900, CVE-2024-23901, CVE-2024-23902, CVE-2024-23903, CVE-2024-23904, CVE-2024-23905