CVE-2020-2123: RCE vulnerability in RadarGun Plugin
Summary
CVE-2020-2123: RCE vulnerability in RadarGun Plugin. Affects org.jenkins-ci.plugins:radargun versions < 1.8. Fixed in 1.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The RadarGun Plugin is a Maven package used in Jenkins, an open-source automation server. It provides functionality for performance testing and benchmarking. The plugin allows users to configure build steps for RadarGun, enabling them to execute performance tests on their Jenkins projects. However, versions 1.7 and earlier of the plugin suffer from a remote code execution vulnerability due to improper configuration of the YAML parser. This vulnerability can be exploited by users with the ability to configure RadarGun Plugin's build step.
Vulnerability Detail
The vulnerability in RadarGun Plugin arises from its failure to properly configure the YAML parser, which allows for the instantiation of arbitrary types. This oversight enables remote code execution, potentially leading to unauthorized access, data breaches, or system compromise. Attackers with the necessary permissions can exploit this vulnerability by manipulating the YAML configuration in RadarGun Plugin's build step. The impact of this vulnerability is rated as HIGH with a CVSS score of 8.8.
How To Fix
Minimum fixed version
1.8
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is crucial to update to the fixed version (1.8 or later) to ensure the security of the RadarGun Plugin.
Conclusion
The RCE vulnerability in RadarGun Plugin (CVE-2020-2123) poses a significant risk to Jenkins users. It allows for remote code execution, potentially leading to severe consequences. To mitigate this vulnerability, it is crucial to update to RadarGun Plugin version 1.8 or later. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:radargun →
FAQ
The RadarGun Plugin is a Maven package used in Jenkins for performance testing and benchmarking.
Versions 1.7 and earlier of the RadarGun Plugin are affected by this vulnerability.
The vulnerability allows for remote code execution, potentially leading to unauthorized access, data breaches, or system compromise.
To fix this vulnerability, upgrade to RadarGun Plugin version 1.8 or later.
No specific workaround is available. It is recommended to update to the fixed version.
