CVE-2019-16549: Jenkins Maven Release Plug-in Plugin XXE vulnerability
Summary
CVE-2019-16549: Jenkins Maven Release Plug-in Plugin XXE vulnerability. Affects org.jenkins-ci.plugins.m2release:m2release versions < 0.16.2. Fixed in 0.16.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Maven Release Plug-in Plugin is a plugin for the Jenkins automation server that allows users to release Maven projects. It retrieves XML from Nexus repository manager APIs. Maven Release Plug-in Plugin 0.16.1 and earlier versions do not configure the XML parser to prevent XML external entity (XXE) attacks. This vulnerability can be exploited by attackers through man-in-the-middle attacks, especially if the Nexus URL is not secured with HTTPS. Although Jenkins users without Overall/Administer permission cannot configure a custom Nexus URL, the vulnerability still poses a risk. Additionally, a connection test form validation method does not require POST requests, making it vulnerable to cross-site request forgery attacks. These vulnerabilities can enable attackers to extract secrets from the Jenkins controller, perform server-side request forgery, or launch denial-of-service attacks.
Vulnerability Detail
The Jenkins Maven Release Plug-in Plugin 0.16.1 and earlier versions are vulnerable to XML external entity (XXE) attacks. Attackers can exploit this vulnerability to extract sensitive information, perform server-side request forgery, or launch denial-of-service attacks. The lack of XML parser configuration and the absence of POST request requirement in the connection test form validation method make it possible for attackers to manipulate crafted XML documents. This vulnerability has a CVSS score of 7.1, indicating a high severity level.
How To Fix
Minimum fixed version
0.16.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of the Maven Release Plug-in Plugin.
Conclusion
The Jenkins Maven Release Plug-in Plugin is vulnerable to an XXE vulnerability that can be exploited to extract sensitive information, perform server-side request forgery, or launch denial-of-service attacks. It is crucial to upgrade to Maven Release Plug-in Plugin version 0.16.2 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins.m2release:m2release →
FAQ
This vulnerability allows attackers to extract sensitive information, perform server-side request forgery, or launch denial-of-service attacks.
While Jenkins users without Overall/Administer permission cannot configure a custom Nexus URL, the vulnerability can still be exploited through man-in-the-middle attacks, especially if the Nexus URL is not secured with HTTPS.
No, there is no known workaround for this vulnerability. It is crucial to upgrade to the fixed version of the Maven Release Plug-in Plugin.
The CVSS score of this vulnerability is 7.1, indicating a high severity level.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just the pom.xml file, without requiring access to the code or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins.m2release:m2release.
