CVE-2018-1000153: Jenkins vSphere Plugin Cross-Site Request Forgery vulnerability in org.jenkins-ci.plugins:vsphere-cloud
Summary
CVE-2018-1000153: Jenkins vSphere Plugin Cross-Site Request Forgery vulnerability. Affects org.jenkins-ci.plugins:vsphere-cloud versions < 2.17. Fixed in 2.17. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins vSphere Plugin is a plugin for the Jenkins automation server that allows users to provision and manage virtual machines in vSphere environments. It provides integration with vSphere servers and enables users to perform various actions such as cloning, deploying, and managing virtual machines.
Vulnerability Detail
A Cross-Site Request Forgery (CSRF) vulnerability exists in the Jenkins vSphere Plugin version 2.16 and older. The vulnerability is present in multiple classes within the plugin, including Clone.java, CloudSelectorParameter.java, ConvertToTemplate.java, and others. Attackers can exploit this vulnerability to perform form validation related actions, such as sending numerous requests to the configured vSphere server, potentially leading to denial of service. Additionally, attackers can send credentials stored in Jenkins with a known ID to an attacker-specified server by exploiting the 'test connection' functionality. The vulnerability is due to the lack of POST request requirement for form validation methods, making it susceptible to CSRF attacks. Starting from version 2.17, the form validation methods now require POST requests and appropriate user permissions, mitigating the vulnerability.
How To Fix
Minimum fixed version
2.17
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of the Jenkins vSphere Plugin.
Conclusion
The Jenkins vSphere Plugin version 2.16 and older are vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability. This vulnerability can be exploited by attackers to perform form validation related actions and potentially cause denial of service or leak credentials. Users should upgrade to version 2.17 or later of the plugin to fix the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:vsphere-cloud →
FAQ
The vulnerability allows attackers to perform form validation related actions and potentially cause denial of service by sending numerous requests to the vSphere server. It also enables attackers to send stored credentials to an attacker-specified server.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using just the pom.xml file.
Yes, the fix for this vulnerability is available in version 2.17 or later of the Jenkins vSphere Plugin. Users are advised to upgrade to the latest version to mitigate the vulnerability.
No, there are no known workarounds for this vulnerability. Upgrading to the fixed version is the recommended solution.
You can find more information about this vulnerability in the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-2g32-2j8w-2qgf/GHSA-2g32-2j8w-2qgf.json
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:vsphere-cloud.
