CVE-2019-10468: Jenkins Kubernetes CI/CD Plugin vulnerable to Cross-Site Request Forgery
Summary
CVE-2019-10468: Jenkins Kubernetes CI/CD Plugin vulnerable to Cross-Site Request Forgery. Affects com.elasticbox.jenkins-ci.plugins:kubernetes-ci versions < 1.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Kubernetes CI/CD Plugin is a Maven package named com.elasticbox.jenkins-ci.plugins:kubernetes-ci. It is designed to integrate Jenkins with Kubernetes for continuous integration and continuous deployment (CI/CD) workflows. The plugin allows users to manage and deploy applications on Kubernetes clusters directly from Jenkins. However, a vulnerability has been discovered in the plugin that exposes it to Cross-Site Request Forgery (CSRF) attacks.
Vulnerability Detail
The vulnerability in the Jenkins Kubernetes CI/CD Plugin allows attackers to perform CSRF attacks by connecting to a URL of their choice using credentials obtained through another method. This can lead to the capture of credentials stored in Jenkins. The plugin has been suspended by Jenkins due to the severity of the vulnerability. The Common Vulnerability Scoring System (CVSS) score for this vulnerability is 8.8, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, as a general best practice, it is recommended to implement strong authentication and authorization mechanisms in Jenkins to mitigate the risk of CSRF attacks.
Conclusion
The Jenkins Kubernetes CI/CD Plugin is vulnerable to Cross-Site Request Forgery (CSRF), which can lead to the capture of credentials stored in Jenkins. Jenkins has suspended distribution of this plugin, and it is advised to find an alternative solution or plugin for integrating Jenkins with Kubernetes. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.elasticbox.jenkins-ci.plugins:kubernetes-ci →
FAQ
The vulnerability allows attackers to capture credentials stored in Jenkins, potentially leading to unauthorized access to sensitive information or systems.
Jenkins has suspended distribution of this plugin, so it is advisable to find an alternative solution or plugin for integrating Jenkins with Kubernetes.
Cross-Site Request Forgery (CSRF) is an attack that tricks the victim into submitting a malicious request. In the context of this vulnerability, it allows attackers to perform actions on behalf of the victim by exploiting the trust between the victim's browser and the vulnerable Jenkins plugin.
To protect your Jenkins instance from CSRF attacks, you should implement strong authentication and authorization mechanisms, use CSRF tokens, and regularly update and patch vulnerable plugins.
Yes, there are alternative plugins and solutions available for integrating Jenkins with Kubernetes. It is recommended to explore other plugins or consult the Jenkins community for recommendations.
Related vulnerabilities
Recent vulnerabilities recorded for com.elasticbox.jenkins-ci.plugins:kubernetes-ci.
