CVE-2020-2179: RCE vulnerability in Jenkins Yaml Axis Plugin
Summary
CVE-2020-2179: RCE vulnerability in Jenkins Yaml Axis Plugin. Affects org.jenkins-ci.plugins:yaml-axis versions < 0.2.1. Fixed in 0.2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Yaml Axis Plugin is a Maven package that provides functionality for configuring multi-configuration (Matrix) jobs in Jenkins. It allows users to define different axes for a job, enabling the execution of multiple configurations in parallel. The plugin utilizes YAML parsing to process the configuration data. However, versions 0.2.0 and earlier of the plugin do not properly configure the YAML parser, making it susceptible to a remote code execution (RCE) vulnerability. This vulnerability can be exploited by users who can configure a Matrix job or control the contents of a previously configured job's SCM repository.
Vulnerability Detail
The vulnerability in the Yaml Axis Plugin arises from the lack of proper configuration of the YAML parser. This allows for the instantiation of arbitrary types, leading to the potential execution of remote code. An attacker with the ability to configure a Matrix job or manipulate the contents of a job's SCM repository can exploit this vulnerability. The impact of a successful exploit can be severe, as it grants the attacker the ability to execute arbitrary code within the Jenkins environment, potentially compromising the entire system.
How To Fix
Minimum fixed version
0.2.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of the Yaml Axis Plugin is not immediately feasible, users can apply a workaround by disabling or removing the Yaml Axis Plugin from their Jenkins installation. This can be done by navigating to the Jenkins plugin management interface and deactivating or uninstalling the Yaml Axis Plugin. However, it is important to note that this workaround may impact the functionality of Matrix jobs that rely on the Yaml Axis Plugin.
Conclusion
The RCE vulnerability in the Jenkins Yaml Axis Plugin (CVE-2020-2179) poses a significant risk to Jenkins installations. It allows for remote code execution, potentially leading to a complete compromise of the system. Users are strongly advised to upgrade to Yaml Axis Plugin version 0.2.1 or later to mitigate this vulnerability. Alternatively, the plugin can be disabled or removed as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:yaml-axis →
FAQ
The vulnerability allows for remote code execution, enabling an attacker to execute arbitrary code within the Jenkins environment. This can lead to a complete compromise of the system.
Users who have the ability to configure a Matrix job or control the contents of a job's SCM repository can exploit this vulnerability.
There are no known instances of this vulnerability being exploited in the wild at this time.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software, using just the pom.xml file.
Yes, the CVSS score for this vulnerability is 8.8, indicating a high severity level.
