CVE-2020-2187: Amazon EC2 Plugin - Lack of SSL/TLS certificate and hostname validation
Summary
CVE-2020-2187: Lack of SSL/TLS certificate and hostname validation in Amazon EC2 Plugin. Affects org.jenkins-ci.plugins:ec2 versions < 1.50.2. Fixed in 1.50.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Amazon EC2 Plugin is a Maven package that allows Jenkins to connect to Windows agents via HTTPS. It provides functionality for managing and provisioning Windows instances on Amazon EC2. The plugin is widely used in Jenkins environments to enable seamless integration with Amazon Web Services (AWS) for automated build and deployment processes. However, versions 1.50.1 and earlier of the plugin suffer from a vulnerability that allows the acceptance of self-signed HTTPS certificates without proper validation of the hostname. This flaw exposes the connection to potential man-in-the-middle attacks, compromising the security of the build agents.
Vulnerability Detail
The lack of SSL/TLS certificate and hostname validation in Amazon EC2 Plugin versions 1.50.1 and earlier poses a significant security risk. Attackers can exploit this vulnerability by intercepting the connections between Jenkins and Windows agents, potentially gaining unauthorized access to sensitive information or injecting malicious code. The absence of proper certificate validation allows self-signed certificates to be accepted, even if they are not trusted. Additionally, the absence of hostname validation makes it easier for attackers to impersonate the intended server and carry out man-in-the-middle attacks.
How To Fix
Minimum fixed version
1.50.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to version 1.50.2 is not immediately feasible, a temporary workaround is to manually configure the plugin to accept self-signed certificates and disable hostname validation. However, this workaround is not recommended as it introduces significant security risks. To implement the workaround, modify the plugin configuration to enable the unsafe behavior. Please note that this should only be considered as a temporary solution until the plugin can be upgraded to a secure version.
Conclusion
The lack of SSL/TLS certificate and hostname validation in Amazon EC2 Plugin versions 1.50.1 and earlier poses a significant security risk to Jenkins environments using this plugin. It is crucial to upgrade to version 1.50.2 or later to mitigate the vulnerability. Administrators should follow the recommended configuration settings and ensure that the plugin is kept up to date. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:ec2 →
FAQ
The vulnerability allows attackers to intercept connections between Jenkins and Windows agents, potentially compromising the confidentiality and integrity of the build process. It can lead to unauthorized access, data leakage, or the injection of malicious code.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file of your project.
Yes, upgrading to Amazon EC2 Plugin version 1.50.2 or later fixes the vulnerability. It is recommended to update the plugin as soon as possible to ensure the security of your Jenkins environment.
While upgrading to the latest version is the best solution, you can apply a temporary workaround by configuring the plugin to accept self-signed certificates and disable hostname validation. However, this workaround introduces security risks and should only be considered as a temporary measure.
The plugin documentation provides detailed information on securing the connection to Windows AMIs. You can refer to the documentation available at https://github.com/jenkinsci/ec2-plugin/#securing-the-connection-to-windows-amis for step-by-step instructions.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:ec2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
