CVE-2020-2091: Missing permission checks in Jenkins Amazon EC2 Plugin
Summary
CVE-2020-2091: Missing permission checks in Jenkins Amazon EC2 Plugin. Affects org.jenkins-ci.plugins:ec2 versions < 1.48. Fixed in 1.48. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Amazon EC2 Plugin is a Maven package that provides integration between Jenkins and Amazon EC2, allowing users to dynamically provision EC2 instances as build agents. It offers features such as launching and terminating instances, managing security groups, and configuring instance templates. This plugin is widely used in Jenkins environments to scale build capacity and leverage cloud resources.
Vulnerability Detail
The Amazon EC2 Plugin version 1.47 and earlier suffer from missing permission checks in methods performing form validation. This means that users with Overall/Read access to Jenkins can connect to an attacker-specified URL within the AWS region using attacker-specified credentials IDs obtained through another method. This vulnerability could potentially allow attackers to capture credentials stored in Jenkins, although this has not been confirmed. Additionally, these form validation methods do not require POST requests, making the plugin vulnerable to Cross-Site Request Forgery (CSRF) attacks. The vulnerability has been assigned a CVSS score of 5.0, indicating a moderate severity level.
How To Fix
Minimum fixed version
1.48
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to restrict access to the Jenkins instance by ensuring that only trusted users have Overall/Read access. Additionally, implementing network-level controls such as firewalls and access control lists (ACLs) can help mitigate the risk of unauthorized access to the Jenkins instance.
Conclusion
The Jenkins Amazon EC2 Plugin version 1.47 and earlier are affected by a vulnerability that allows unauthorized users to connect to attacker-specified URLs within the AWS region using attacker-specified credentials IDs. This could potentially lead to unauthorized access to AWS resources and the capture of credentials stored in Jenkins. Upgrading to version 1.48 or later, which introduces the required permission checks and POST request validation, is recommended to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:ec2 →
FAQ
This vulnerability allows users with Overall/Read access to Jenkins to connect to an attacker-specified URL within the AWS region using attacker-specified credentials IDs. It could potentially lead to unauthorized access to AWS resources and the capture of credentials stored in Jenkins.
Yes, this vulnerability can be exploited remotely by sending a crafted request to the affected form validation methods.
There is currently no confirmed evidence of credentials being captured through this vulnerability. However, it is still recommended to upgrade to the latest version to mitigate the risk.
Implementing network-level controls such as firewalls and access control lists (ACLs) can help mitigate the risk of unauthorized access to the Jenkins instance. Additionally, restricting access to trusted users with Overall/Read access can provide temporary protection.
Yes, this vulnerability has been assigned a CVSS score of 5.0, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:ec2.
