CVE-2019-10337: Jenkins Token Macro Plugin - Improper Restriction of XML External Entity Reference
Summary
CVE-2019-10337: Improper Restriction of XML External Entity Reference Jenkins Token Macro Plugin. Affects org.jenkins-ci.plugins:token-macro versions < 2.8. Fixed in 2.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Token Macro Plugin is a Maven package that provides functionality for defining and using tokens in Jenkins. Tokens are used to dynamically insert values into build steps, such as usernames, passwords, or other sensitive information. The plugin allows users to define custom tokens and use them in various parts of their Jenkins configuration. However, a vulnerability in versions 2.7 and earlier of the plugin allows attackers to exploit XML external entities (XXE) and potentially extract secrets, perform server-side request forgery, or launch denial-of-service attacks.
Vulnerability Detail
The vulnerability arises from improper restriction of XML external entity references in the "XML" macro of the Jenkins Token Macro Plugin. Attackers who can control the content of the input file for this macro can manipulate it to have Jenkins resolve external entities. This can lead to the extraction of secrets from the Jenkins agent, server-side request forgery, or denial-of-service attacks. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
2.8
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of the plugin as soon as possible.
Conclusion
The Jenkins Token Macro Plugin versions 2.7 and earlier are vulnerable to an XML external entities (XXE) vulnerability. This can lead to the extraction of secrets, server-side request forgery, or denial-of-service attacks. Users should upgrade to version 2.8 or later of the plugin to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:token-macro →
FAQ
The vulnerability allows attackers to extract secrets from the Jenkins agent, perform server-side request forgery, or launch denial-of-service attacks.
Versions 2.7 and earlier of the plugin are affected.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your pom.xml file and the playground will analyze it for open-source vulnerabilities in real-time.
Yes, upgrading to version 2.8 or later of the Jenkins Token Macro Plugin fixes this vulnerability.
No, there are no known workarounds for this vulnerability. It is recommended to upgrade to the fixed version of the plugin.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:token-macro.
