CVE-2019-10340: Jenkins Docker Plugin Cross-Site Request Forgery
Summary
CVE-2019-10340: Jenkins Docker Plugin contains Cross-Site Request Forgery. Affects io.jenkins.docker:docker-plugin versions < 1.1.7. Fixed in 1.1.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Docker Plugin is a Maven package (io.jenkins.docker:docker-plugin) that provides integration between Jenkins and Docker, allowing users to build, deploy, and manage Docker containers within Jenkins. This plugin enables developers to leverage the power of Docker for their CI/CD workflows. However, versions 1.1.6 and earlier of the plugin are vulnerable to a Cross-Site Request Forgery (CSRF) attack.
Vulnerability Detail
The CSRF vulnerability in Jenkins Docker Plugin allows an attacker to exploit the DockerAPI.DescriptorImpl#doTestConnection method. By leveraging Overall/Read access, an attacker can connect to a URL of their choice using credentials IDs obtained through another method. This allows them to capture credentials stored in Jenkins. The impact of this vulnerability is significant as it can lead to unauthorized access, data leakage, and potential compromise of the Jenkins environment.
How To Fix
Minimum fixed version
1.1.7
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the Jenkins Docker Plugin by limiting Overall/Read access to trusted individuals or groups. This can be done through Jenkins' access control settings. Additionally, it is advisable to regularly monitor Jenkins logs and audit trails for any suspicious activity.
Conclusion
The Jenkins Docker Plugin vulnerability (CVE-2019-10340) poses a significant risk to Jenkins instances using versions 1.1.6 and earlier of the plugin. It is crucial to promptly update to version 1.1.7 or later to mitigate the Cross-Site Request Forgery (CSRF) vulnerability. Regularly monitoring for security updates and maintaining an up-to-date plugin ecosystem is essential for maintaining a secure Jenkins environment. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for io.jenkins.docker:docker-plugin →
FAQ
Cross-Site Request Forgery (CSRF) is an attack that tricks the victim into submitting a malicious request. In the case of the Jenkins Docker Plugin vulnerability, it allows an attacker to perform actions on behalf of an authenticated user without their consent.
The vulnerability can lead to unauthorized access to Jenkins, potential data leakage, and compromise of the Jenkins environment. Attackers can capture credentials stored in Jenkins and use them for malicious purposes.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins instance is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file of your application.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is crucial to patch and update vulnerable versions of the Jenkins Docker Plugin to prevent potential exploitation.
If your Jenkins instance is affected, it is recommended to upgrade to version 1.1.7 or later of the Jenkins Docker Plugin. Additionally, review your Jenkins access control settings, restrict Overall/Read access to trusted individuals or groups, and monitor logs for any suspicious activity.
Related vulnerabilities
Recent vulnerabilities recorded for io.jenkins.docker:docker-plugin.
