CVE-2020-2120: XXE vulnerability in FitNesse Plugin
Summary
CVE-2020-2120: XXE vulnerability in FitNesse Plugin. Affects org.jenkins-ci.plugins:fitnesse versions < 1.31. Fixed in 1.31. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FitNesse Plugin is a Maven package (org.jenkins-ci.plugins:fitnesse) used in Jenkins, an open-source automation server. The FitNesse Plugin allows users to integrate FitNesse, a web server and wiki for organizing and running tests, into their Jenkins pipelines. This plugin enables users to configure post-build steps that parse XML files. However, versions 1.30 and earlier of the FitNesse Plugin do not properly configure the XML parser, making it vulnerable to XML external entity (XXE) attacks.
Vulnerability Detail
The XXE vulnerability in FitNesse Plugin allows an attacker who can control the input files for its post-build step to exploit the XML parser and perform various malicious activities. These activities include extracting secrets from the Jenkins controller, initiating server-side request forgery (SSRF) attacks, or causing denial-of-service (DoS) attacks. By crafting a malicious file that utilizes external entities, an attacker can manipulate the XML parsing process to execute arbitrary code or access sensitive information.
How To Fix
Minimum fixed version
1.31
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, users can mitigate the risk by updating the FitNesse Plugin to the latest version as mentioned in the 'how_to_fix' section.
Conclusion
The XXE vulnerability in FitNesse Plugin (CVE-2020-2120) exposes Jenkins pipelines to potential attacks, including information extraction, SSRF, and DoS. To mitigate this risk, it is crucial to update the FitNesse Plugin to version 1.31 or later. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:fitnesse →
FAQ
FitNesse Plugin is a Maven package used in Jenkins to integrate FitNesse, a web server and wiki for organizing and running tests, into Jenkins pipelines.
An XXE vulnerability is a type of security flaw that allows an attacker to exploit an XML parser by injecting malicious external entities into XML input. This can lead to various attacks, such as information disclosure, SSRF, or DoS.
This vulnerability can enable an attacker to extract sensitive information from the Jenkins controller, perform SSRF attacks, or cause DoS by manipulating the XML parsing process.
To fix this vulnerability, update the FitNesse Plugin to version 1.31 or later, which disables external entity processing for the XML parser.
There is no specific workaround provided for this vulnerability. Updating to the latest version of the FitNesse Plugin is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:fitnesse.
