CVE-2019-10392: Jenkins Git Client Plugin - OS Command Injection
Summary
CVE-2019-10392: Improper Neutralization of Special Elements used in an OS Command in Jenkins Git Client Plugin. Affects org.jenkins-ci.plugins:git-client versions < 2.8.5. Fixed in 2.8.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Git Client Plugin is a Maven package (org.jenkins-ci.plugins:git-client) that provides functionality for interacting with Git repositories within the Jenkins automation server. It allows users to perform various Git operations, such as cloning, fetching, and pushing code. The plugin integrates Git functionality into Jenkins pipelines and jobs, enabling seamless source code management and version control.
Vulnerability Detail
The Jenkins Git Client Plugin version 2.8.4 and earlier are affected by an OS command injection vulnerability (CVE-2019-10392). This vulnerability arises due to improper neutralization of special elements used in an OS command. Specifically, the plugin fails to properly restrict values passed as URL arguments to the 'git ls-remote' command. As a result, an attacker can inject malicious commands into the URL argument, leading to arbitrary command execution on the underlying operating system. This vulnerability has a CVSS score of 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
How To Fix
Minimum fixed version
2.8.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the 'git ls-remote' command in the Jenkins Git Client Plugin configuration. This can be achieved by modifying the Jenkins job or pipeline configuration to avoid using the 'git ls-remote' command. However, this workaround may limit certain Git functionality and is not a permanent solution. It is strongly recommended to apply the official fix by upgrading to the latest version of the plugin.
Conclusion
The Jenkins Git Client Plugin version 2.8.4 and earlier are vulnerable to OS command injection, allowing attackers to execute arbitrary commands on the underlying operating system. To mitigate this vulnerability, it is crucial to upgrade to version 2.8.5 or later. Applying the official fix ensures that URL arguments passed to the 'git ls-remote' command are properly sanitized, preventing command injection attacks. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:git-client →
FAQ
This vulnerability allows an attacker to execute arbitrary commands on the underlying operating system, potentially leading to unauthorized access, data breaches, or further compromise of the Jenkins automation server.
No, only versions up to and including 2.8.4 are affected. The vulnerability has been fixed in version 2.8.5 and later.
No, authentication is not required. An attacker can exploit this vulnerability remotely without any authentication.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability. However, it is advisable to apply the fix as soon as possible to mitigate any potential risks.
Yes, this vulnerability has a CVSS score of 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:git-client.
