Jenkins Security Advisory 2021-03-18

This advisory announces vulnerabilities in the following Jenkins deliverables:

Descriptions

Incorrect permission checks in Matrix Authorization Strategy Plugin may allow accessing some items

SECURITY-2180 / CVE-2021-21623
Severity (CVSS): Medium
Affected plugin: matrix-auth
Description:

Items (like jobs) can be organized hierarchically in Jenkins, using the Folders Plugin or something similar. An item is expected to be accessible only if all its ancestors are accessible as well.

Matrix Authorization Strategy Plugin 2.6.5 and earlier does not correctly perform permission checks to determine whether an item should be accessible.

This allows attackers with Item/Read permission on nested items to access them, even if they lack Item/Read permission for parent folders.

Matrix Authorization Strategy Plugin 2.6.6 requires Item/Read permission on parent items to grant Item/Read permission on an individual item.

As a workaround in older releases, do not grant permissions on individual items to users who do not have access to parent items.

In case of problems, the Java system property hudson.security.AuthorizationMatrixProperty.checkParentPermissions can be set to false, completely disabling this fix.

Incorrect permission checks in Role-based Authorization Strategy Plugin may allow accessing some items

SECURITY-2182 / CVE-2021-21624
Severity (CVSS): Medium
Affected plugin: role-strategy
Description:

Items (like jobs) can be organized hierarchically in Jenkins, using the Folders Plugin or something similar. An item is expected to be accessible only if all its ancestors are accessible as well.

Role-based Authorization Strategy Plugin 3.1 and earlier does not correctly perform permission checks to determine whether an item should be accessible.

This allows attackers with Item/Read permission on nested items to access them, even if they lack Item/Read permission for parent folders.

Role-based Authorization Strategy Plugin 3.1.1 requires Item/Read permission on parent items to grant Item/Read permission on an individual item.

As a workaround in older releases, do not grant permissions on individual items to users who do not have access to parent items.

In case of problems, the Java system property com.michelin.cio.hudson.plugins.rolestrategy.RoleMap.checkParentPermissions can be set to false, completely disabling this fix.

Missing permission checks in CloudBees AWS Credentials Plugin allows enumerating credentials IDs

SECURITY-2032 / CVE-2021-21625
Severity (CVSS): Medium
Affected plugin: aws-credentials
Description:

CloudBees AWS Credentials Plugin 1.28 and earlier does not perform a permission check in a helper method for HTTP endpoints.

This allows attackers with Overall/Read permission to enumerate credentials IDs of AWS credentials stored in Jenkins if any of the following plugins are installed:

Further plugins may use this helper method as well without performing a permission check themselves.

Credentials IDs obtained this way can be used as part of an attack to capture the credentials using another vulnerability.

CloudBees AWS Credentials Plugin 1.28.1 performs permission checks in the helper method for HTTP endpoints.

Missing permission checks in Warnings Next Generation Plugin allow listing workspace contents

SECURITY-2041 / CVE-2021-21626
Severity (CVSS): Medium
Affected plugin: warnings-ng
Description:

Warnings Next Generation Plugin 8.4.4 and earlier does not perform permission checks in methods implementing form validation.

This allows attackers with Item/Read permission but without Item/Workspace or Item/Configure permission to check whether attacker-specified file patterns match workspace contents. A sequence of requests can be used to effectively list workspace contents.

Warnings Next Generation Plugin 8.5.0 requires Item/Configure permission to validate patterns with workspace contents.

CSRF vulnerability in Libvirt Agents Plugin

SECURITY-1764 / CVE-2021-21627
Severity (CVSS): Medium
Affected plugin: libvirt-slave
Description:

Libvirt Agents Plugin 1.9.0 and earlier does not require POST requests for a form submission endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to stop hypervisor domains.

Libvirt Agents Plugin 1.9.1 requires POST requests for the affected HTTP endpoint.

Severity

Affected Versions

  • CloudBees AWS Credentials Plugin up to and including 1.28
  • Libvirt Agents Plugin up to and including 1.9.0
  • Matrix Authorization Strategy Plugin up to and including 2.6.5
  • Role-based Authorization Strategy Plugin up to and including 3.1
  • Warnings Next Generation Plugin up to and including 8.4.4

Fix

  • CloudBees AWS Credentials Plugin should be updated to version 1.28.1
  • Libvirt Agents Plugin should be updated to version 1.9.1
  • Matrix Authorization Strategy Plugin should be updated to version 2.6.6
  • Role-based Authorization Strategy Plugin should be updated to version 3.1.1
  • Warnings Next Generation Plugin should be updated to version 8.5.0

These versions include fixes to the vulnerabilities described above. All prior versions are considered to be affected by these vulnerabilities unless otherwise indicated.

Credit

The Jenkins project would like to thank the reporters for discovering and reporting these vulnerabilities:

  • Daniel Beck, CloudBees, Inc. for SECURITY-2032, SECURITY-2041, SECURITY-2182
  • Wadeck Follonier, CloudBees, Inc. for SECURITY-1764