CVE-2020-2191: Improper permission checks in Jenkins Swarm Plugin
Summary
CVE-2020-2191: Improper permission checks in Jenkins Swarm Plugin. Affects org.jenkins-ci.plugins:swarm versions < 3.21. Fixed in 3.21. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Swarm Plugin is an extension that allows Jenkins agents to automatically discover and connect to a Jenkins master. It provides a convenient way to dynamically scale Jenkins by adding and removing agents as needed. The plugin adds API endpoints to add or remove agent labels, which are used to categorize agents based on their capabilities. These labels are crucial for assigning jobs to the appropriate agents. However, prior to version 3.21, the plugin had a vulnerability that allowed users with Agent/Create permission to add or remove labels of any agent, without proper permission checks. This could potentially lead to unauthorized access and misuse of agent resources.
Vulnerability Detail
The vulnerability (CVE-2020-2191) in the Jenkins Swarm Plugin arises from the lack of proper permission checks when adding or removing agent labels. In versions 3.20 and earlier, these API endpoints only required a global Swarm secret for authentication, without performing any regular permission checks. This means that users with Agent/Create permission could manipulate the labels of any agent, regardless of their assigned permissions. This vulnerability has a CVSS score of 5.4, indicating a moderate severity level. Exploiting this vulnerability could result in unauthorized access to agent resources and potential misuse of the Jenkins environment.
How To Fix
Minimum fixed version
3.21
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict the permissions of users with Agent/Create permission to minimize the risk of unauthorized label manipulation. By carefully assigning permissions and limiting the number of users with this permission, the impact of the vulnerability can be reduced. However, this workaround is not a permanent solution and should be accompanied by upgrading to the latest version of the Jenkins Swarm Plugin.
Conclusion
In conclusion, the Jenkins Swarm Plugin prior to version 3.21 had a vulnerability that allowed users with Agent/Create permission to manipulate agent labels without proper permission checks. This could result in unauthorized access and misuse of agent resources. Upgrading to version 3.21 or later of the plugin and carefully managing user permissions will mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:swarm →
FAQ
The Jenkins Swarm Plugin is an extension that allows Jenkins agents to automatically discover and connect to a Jenkins master. It enables dynamic scaling of Jenkins by adding and removing agents as needed.
The vulnerability allows users with Agent/Create permission to add or remove labels of any agent, potentially leading to unauthorized access and misuse of agent resources.
The CVSS score of this vulnerability is 5.4, indicating a moderate severity level.
To fix this vulnerability, it is recommended to upgrade to version 3.21 or later of the Jenkins Swarm Plugin.
As a temporary workaround, users can restrict the permissions of users with Agent/Create permission and carefully assign permissions to minimize the risk.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:swarm.
