CVE-2019-16548: Jenkins Google Compute Engine Plugin Cross-Site Request Forgery vulnerability
Summary
CVE-2019-16548: Jenkins Google Compute Engine Plugin Cross-Site Request Forgery vulnerability. Affects org.jenkins-ci.plugins:google-compute-engine versions < 4.2.0. Fixed in 4.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Google Compute Engine Plugin is a Maven package that provides integration between Jenkins and Google Compute Engine. It allows users to provision and manage agents on Google Compute Engine. The plugin enables seamless scaling of Jenkins agents on the Google Cloud Platform, providing flexibility and efficiency in resource allocation. However, versions 4.1.1 and earlier of the plugin are vulnerable to a cross-site request forgery (CSRF) attack.
Vulnerability Detail
The vulnerability in the Jenkins Google Compute Engine Plugin allows an attacker to perform a CSRF attack and provision new agents without proper authorization. By tricking a user with elevated privileges into visiting a malicious website or clicking on a crafted link, the attacker can execute unauthorized actions on the Jenkins instance. This can lead to the creation of new agents, potentially consuming resources and compromising the integrity of the Jenkins environment.
How To Fix
Minimum fixed version
4.2.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can consider implementing additional security measures such as enabling CSRF protection in Jenkins and ensuring that users with elevated privileges are cautious when visiting external websites or clicking on untrusted links.
Conclusion
The Jenkins Google Compute Engine Plugin versions 4.1.1 and earlier are vulnerable to a CSRF attack that allows unauthorized provisioning of agents. To mitigate this vulnerability, users should upgrade to version 4.2.0 or later of the plugin. It is important to promptly apply the fix to ensure the security and integrity of the Jenkins environment. For additional support and assistance, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:google-compute-engine →
FAQ
Cross-Site Request Forgery (CSRF) is a type of attack where an attacker tricks a user into performing unwanted actions on a web application without their consent or knowledge. In the case of this vulnerability, it allows the unauthorized provisioning of agents in the Jenkins Google Compute Engine Plugin.
The vulnerability allows an attacker to provision new agents in the Jenkins Google Compute Engine Plugin without proper authorization. This can lead to resource consumption, potential disruption of Jenkins operations, and compromise the integrity of the Jenkins environment.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins installation is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this specific issue.
There are no known public exploits specifically targeting this vulnerability at the time of this report. However, it is important to promptly apply the recommended fix to mitigate the risk of potential exploitation.
For further support and assistance in vulnerability remediation, you can reach out to info@devnack.com. Our team of experts will be happy to assist you in securing your Jenkins installation and addressing any concerns related to this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:google-compute-engine.
