CVE-2020-2117: Missing permission checks in Pipeline GitHub Notify Step Plugin allows capturing credentials
Summary
CVE-2020-2117: Missing permission checks in Pipeline GitHub Notify Step Plugin allows capturing credentials. Affects org.jenkins-ci.plugins:pipeline-githubnotify-step versions < 1.0.5. Fixed in 1.0.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Pipeline GitHub Notify Step Plugin is a plugin for Jenkins, an open-source automation server. It provides a step for notifying GitHub repositories about build status. The plugin allows users to connect to a specified URL using credentials stored in Jenkins. However, versions 1.0.4 and earlier of the plugin have a vulnerability that allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, thereby capturing credentials stored in Jenkins.
Vulnerability Detail
The vulnerability in Pipeline GitHub Notify Step Plugin arises from a missing permission check. Attackers with Overall/Read permission can exploit this vulnerability to connect to a URL of their choice using credentials IDs obtained through another method. This allows them to capture credentials stored in Jenkins. The impact of this vulnerability is significant as it exposes sensitive credentials, which can lead to unauthorized access, data breaches, and other malicious activities.
How To Fix
Minimum fixed version
1.0.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the latest version of the Pipeline GitHub Notify Step Plugin.
Conclusion
The vulnerability in the Pipeline GitHub Notify Step Plugin allows attackers to capture credentials stored in Jenkins. It is crucial to upgrade to version 1.0.5 or later of the plugin to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:pipeline-githubnotify-step →
FAQ
This vulnerability allows attackers to capture credentials stored in Jenkins, potentially leading to unauthorized access, data breaches, and other malicious activities.
Users of Jenkins who have installed the Pipeline GitHub Notify Step Plugin version 1.0.4 or earlier are affected by this vulnerability.
No, there is no known workaround for this vulnerability. It is crucial to update to the latest version of the plugin.
To fix this vulnerability, upgrade to version 1.0.5 or later of the Pipeline GitHub Notify Step Plugin.
For more information about this vulnerability, refer to the CVE-2020-2117 advisory and the Jenkins documentation.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:pipeline-githubnotify-step.
