CVE-2017-1000093: Jenkins Poll SCM Plugin vulnerable to Cross-Site Request Forgery
Summary
CVE-2017-1000093: Jenkins Poll SCM Plugin vulnerable to Cross-Site Request Forgery. Affects org.jenkins-ci.plugins:pollscm versions < 1.3.1. Fixed in 1.3.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Poll SCM Plugin is a component of the Jenkins automation server that allows users to configure periodic polling of source code repositories. This plugin adds a permission to enable this functionality, which is typically used for cache invalidation. However, the plugin did not enforce the use of POST requests for its API, making it susceptible to Cross-Site Request Forgery (CSRF) attacks. This vulnerability allows attackers to initiate polling of projects with a known name, undermining the permission system in place.
Vulnerability Detail
The vulnerability in the Jenkins Poll SCM Plugin arises from the lack of requirement for POST requests to its API. By exploiting this weakness, an attacker can trick authenticated users into unknowingly initiating polling of specific projects. This can lead to unauthorized access to sensitive information or disruption of the build process. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Minimum fixed version
1.3.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. Users are advised to update the plugin to the latest version as soon as possible.
Conclusion
The Jenkins Poll SCM Plugin vulnerability allows for Cross-Site Request Forgery attacks, potentially leading to unauthorized access or disruption of the build process. Users should update the plugin to version 1.3.1 or later to mitigate this vulnerability. It is also recommended to follow security best practices and regularly monitor for any suspicious activity. For further support, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:pollscm →
FAQ
The vulnerability allows attackers to initiate polling of projects with a known name, potentially leading to unauthorized access to sensitive information or disruption of the build process.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins installation is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time.
There are no known public exploits for this vulnerability at the time of this report. However, it is recommended to update the plugin to the latest version to mitigate the risk.
In addition to keeping plugins up to date, it is recommended to follow security best practices such as using strong passwords, enabling two-factor authentication, and regularly reviewing Jenkins logs for any suspicious activity.
For further support on vulnerability remediation, you can reach out to info@devnack.com. They can provide guidance and assistance in addressing this vulnerability.
