CVE-2020-2180: RCE vulnerability in Jenkins AWS SAM Plugin
Summary
CVE-2020-2180: RCE vulnerability in Jenkins AWS SAM Plugin. Affects io.jenkins.plugins:aws-sam versions < 1.2.3. Fixed in 1.2.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins AWS SAM Plugin is a Maven package that provides integration between Jenkins and AWS Serverless Application Model (SAM). It allows users to deploy and manage serverless applications on AWS. The plugin parses YAML SAM template files to configure the deployment process. However, versions 1.2.2 and earlier of the plugin do not properly configure the YAML parser, leading to a remote code execution (RCE) vulnerability. This vulnerability can be exploited by users who can configure a job or control the contents of a previously configured 'AWS SAM deploy application' build step's YAML SAM template file.
Vulnerability Detail
The RCE vulnerability in the Jenkins AWS SAM Plugin (CVE-2020-2180) arises from the insecure configuration of the YAML parser. By exploiting this vulnerability, an attacker with the ability to manipulate the YAML SAM template file can execute arbitrary code on the Jenkins server. This can lead to unauthorized access, data breaches, and potential compromise of the entire Jenkins infrastructure. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Minimum fixed version
1.2.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by updating the AWS SAM Plugin to a secure version.
Conclusion
The RCE vulnerability in the Jenkins AWS SAM Plugin (CVE-2020-2180) poses a significant risk to Jenkins installations using the affected versions of the AWS SAM Plugin. It is crucial to update to version 1.2.3 or later of the plugin to mitigate this vulnerability. Failure to apply the recommended fix may result in unauthorized access, data breaches, and compromise of the Jenkins infrastructure. For assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.jenkins.plugins:aws-sam →
FAQ
This vulnerability allows an attacker to execute arbitrary code on the Jenkins server, potentially leading to unauthorized access, data breaches, and compromise of the entire Jenkins infrastructure.
Users of Jenkins who have the AWS SAM Plugin version 1.2.2 or earlier installed are affected by this vulnerability.
There are no known public exploits for this vulnerability at the time of this report. However, it is crucial to apply the recommended fix to mitigate the risk.
You can use the Vulert Playground at Vulert Scanner to check if your Jenkins installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file for analysis.
For further support on vulnerability remediation, you can contact info@devnack.com. Our team will be happy to assist you.
