CVE-2020-2144: XXE vulnerability in Rundeck Plugin
Summary
CVE-2020-2144: XXE vulnerability in Rundeck Plugin. Affects org.jenkins-ci.plugins:rundeck versions < 3.6.7. Fixed in 3.6.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Rundeck Plugin is a Maven package that integrates Rundeck with Jenkins, allowing users to perform various automation tasks. It provides functionality for managing jobs, executing commands, and monitoring workflows. The plugin is widely used in continuous integration and deployment pipelines. However, versions 3.6.6 and earlier of the Rundeck Plugin are susceptible to an XML external entity (XXE) vulnerability.
Vulnerability Detail
The XXE vulnerability in Rundeck Plugin 3.6.6 and earlier arises from the lack of proper configuration of the XML parser. This oversight enables a user with Overall/Read access to manipulate a crafted HTTP request containing XML data with external entities. An attacker can exploit this vulnerability to extract sensitive information from the Jenkins controller or perform server-side request forgery. Rundeck Plugin 3.6.7 addresses this issue by disabling external entity resolution for its XML parser.
How To Fix
Minimum fixed version
3.6.7
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of the Rundeck Plugin to ensure the security of the application.
Conclusion
The XXE vulnerability in Rundeck Plugin 3.6.6 and earlier poses a significant security risk, allowing unauthorized access to sensitive information and potential server-side request forgery. To mitigate this vulnerability, it is crucial to upgrade to Rundeck Plugin version 3.6.7 or later. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:rundeck →
FAQ
An XML external entity (XXE) vulnerability is a type of attack that exploits the insecure processing of XML data. It allows an attacker to include external entities, leading to information disclosure, server-side request forgery, or denial of service.
This vulnerability enables an attacker to extract sensitive information from the Jenkins controller or perform server-side request forgery. The extracted information can be used for further attacks or unauthorized access.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using just the pom.xml file.
Yes, the fix for this vulnerability is available in Rundeck Plugin version 3.6.7. It is recommended to upgrade to this version to mitigate the XXE vulnerability.
There is no known workaround for this vulnerability. Upgrading to the fixed version is the only recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:rundeck.
