CVE-2020-2185: Missing SSH Host Key Validation in Amazon EC2 Plugin
Summary
CVE-2020-2185: Missing SSH host key validation in Jenkins Amazon EC2 Plugin. Affects org.jenkins-ci.plugins:ec2 versions < 1.50.2. Fixed in 1.50.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Amazon EC2 Plugin is a Maven package that provides integration between Jenkins and Amazon EC2, allowing users to dynamically provision EC2 instances as Jenkins agents. It enables users to scale their Jenkins build environment by automatically launching and terminating EC2 instances as needed. The plugin utilizes SSH for communication between the Jenkins master and the EC2 instances.
Vulnerability Detail
The Amazon EC2 Plugin version 1.50.1 and earlier does not perform SSH host key validation when establishing connections to agents. This lack of validation opens up the possibility of a man-in-the-middle attack, where an attacker can intercept the connection and impersonate the agent. By doing so, the attacker can gain unauthorized access to sensitive information or perform malicious actions on the Jenkins master. The vulnerability has a CVSS score of 5.6, indicating a moderate severity level.
How To Fix
Minimum fixed version
1.50.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the fixed version of the Amazon EC2 Plugin.
Conclusion
The Amazon EC2 Plugin version 1.50.1 and earlier is vulnerable to a missing SSH host key validation issue, which could be exploited through a man-in-the-middle attack. Upgrading to version 1.50.2 or later and implementing SSH host key validation strategies is crucial to mitigate this vulnerability. It is recommended to check your Jenkins instance using the Vulert Playground and apply the necessary fixes. For additional support, reach out to DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:ec2 →
FAQ
This vulnerability allows an attacker to intercept connections between the Jenkins master and EC2 agents, potentially leading to unauthorized access and malicious activities.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins instance is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for open-source vulnerabilities in real-time.
There are no known public exploits for this vulnerability at the time of this advisory. However, it is important to apply the recommended fix to mitigate the risk of potential attacks.
Yes, starting from version 1.50.2, the Amazon EC2 Plugin provides strategies for performing SSH host key validation. Administrators can choose the appropriate validation method based on their security requirements.
For further support and assistance with vulnerability remediation, you can contact info@devnack.com. The Devnack team specializes in helping organizations address security vulnerabilities in their software.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:ec2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
