CVE-2018-1000174: Jenkins Google Login Plugin Open Redirect vulnerability
Summary
CVE-2018-1000174: Jenkins Google Login Plugin Open Redirect vulnerability. Affects org.jenkins-ci.plugins:google-login versions < 1.3.1. Fixed in 1.3.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Google Login Plugin is a plugin for the Jenkins automation server that allows users to log in using their Google accounts. It provides a convenient way for users to authenticate and access Jenkins. The plugin integrates with the Google OAuth 2.0 authentication system to enable secure login using Google credentials. However, versions 1.3 and older of the plugin are vulnerable to an open redirect vulnerability.
Vulnerability Detail
The open redirect vulnerability in Jenkins Google Login Plugin allows attackers to redirect users to arbitrary URLs after a successful login. This can be exploited by an attacker to trick users into visiting malicious websites or disclosing sensitive information. The vulnerability exists in the GoogleOAuth2SecurityRealm.java file of the plugin. The issue was fixed in version 1.3.1, which now only allows redirects to relative URLs.
How To Fix
Minimum fixed version
1.3.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the latest version of the plugin as soon as possible.
Conclusion
The Jenkins Google Login Plugin versions 1.3 and older are vulnerable to an open redirect vulnerability, which allows attackers to redirect users to arbitrary URLs. This can lead to phishing attacks or disclosure of sensitive information. Users should upgrade to version 1.3.1 or later of the plugin to fix the vulnerability. For further support, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:google-login →
FAQ
The vulnerability allows attackers to redirect users to arbitrary URLs, potentially leading to phishing attacks or disclosure of sensitive information.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins installation is affected by this vulnerability. Simply enter your pom.xml file and the playground will analyze it for open-source vulnerabilities in real-time.
There are no known public exploits for this vulnerability at the time of writing. However, it is still important to upgrade to the latest version of the plugin to mitigate the risk.
No, the vulnerability is a code-level issue in the plugin and requires a fix from the plugin developers. It is recommended to upgrade to the latest version to ensure the vulnerability is properly addressed.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide assistance and guidance on fixing the vulnerability in your Jenkins installation.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:google-login.
