CVE-2020-2108: XXE vulnerability in Jenkins WebSphere Deployer Plugin
Summary
CVE-2020-2108: XXE vulnerability in Jenkins WebSphere Deployer Plugin. Affects org.jenkins-ci.plugins:websphere-deployer versions < 1.6.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The WebSphere Deployer Plugin is a plugin for Jenkins, a popular open-source automation server. It allows users to deploy applications to IBM WebSphere Application Server. The plugin provides functionality for uploading and parsing WAR files, which contain the necessary files and configurations for deploying applications. However, versions 1.6.1 and earlier of the plugin do not properly configure the XML parser, making them vulnerable to XML external entity (XXE) attacks. This means that an attacker with Job/Configure permissions can upload a specially crafted WAR file containing a WEB-INF/ibm-web-ext.xml file that will be parsed by the plugin.
Vulnerability Detail
The XXE vulnerability in the WebSphere Deployer Plugin allows an attacker to exploit the XML parser's lack of protection against external entities. By uploading a malicious WAR file with a specially crafted ibm-web-ext.xml file, an attacker can perform various attacks, such as reading arbitrary files from the server's filesystem, initiating network connections to external systems, or launching denial-of-service attacks. This vulnerability can be exploited by a user with Job/Configure permissions, potentially leading to unauthorized access, data leakage, or disruption of service.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the WebSphere Deployer Plugin or restrict access to it. By disabling the plugin, the vulnerability is effectively mitigated, but it also means that the functionality provided by the plugin will be unavailable. Alternatively, access to the plugin can be restricted to trusted users only, reducing the potential attack surface.
Conclusion
The XXE vulnerability in the WebSphere Deployer Plugin exposes users to potential unauthorized access, data leakage, and service disruption. It is crucial for users to upgrade to a fixed version of the plugin or apply the temporary workaround to mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:websphere-deployer →
FAQ
An XML external entity (XXE) vulnerability is a type of attack that exploits the way XML parsers process external entities. By including malicious external entities in XML input, an attacker can read arbitrary files, initiate network connections, or perform other actions on the server.
Users of the WebSphere Deployer Plugin versions 1.6.1 and earlier are affected by this vulnerability. Specifically, users with Job/Configure permissions are at risk.
An attacker can exploit this vulnerability to read arbitrary files from the server's filesystem, initiate network connections to external systems, or launch denial-of-service attacks. The exact impact depends on the attacker's intentions and the server's configuration.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file to provide accurate vulnerability information.
You can find more information about the WebSphere Deployer Plugin on the official Jenkins website or in the plugin's documentation. These resources provide details on the plugin's functionality, usage, and how to upgrade to the latest version.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:websphere-deployer.
