CVE-2020-2196: OS Command Injection in Jenkins Selenium Plugin
Summary
CVE-2020-2196: Complete lack of CSRF protection in Jenkins Selenium Plugin can lead to OS command injection. Affects org.jenkins-ci.plugins:selenium versions < 3.141.59. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Selenium Plugin is a Maven-based plugin that allows users to integrate Selenium Grid with Jenkins. It provides functionality for managing Selenium configurations on specific nodes and controlling the Selenium Grid hub. The plugin is widely used for automated testing in software development workflows.
Vulnerability Detail
The Selenium Plugin version 3.141.59 and earlier suffer from a complete lack of Cross-Site Request Forgery (CSRF) protection for its HTTP endpoints. This vulnerability enables attackers to perform various malicious actions, including restarting the Selenium Grid hub, deleting or replacing the plugin configuration, and starting, stopping, or restarting Selenium configurations on specific nodes. By carefully manipulating configuration parameters, an attacker can exploit this vulnerability to execute arbitrary OS commands on the Jenkins controller, leading to potential remote code execution.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable or restrict access to the Selenium Plugin's HTTP endpoints. This can be achieved by configuring network firewalls or access control lists (ACLs) to block external access to the plugin's URLs. However, this workaround may impact the functionality of the plugin and is not a long-term solution.
Conclusion
The lack of CSRF protection in the Jenkins Selenium Plugin exposes users to the risk of OS command injection and potential remote code execution. It is crucial to update the plugin to a version that includes CSRF protection and regularly apply security patches. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:selenium →
FAQ
This vulnerability allows attackers to execute arbitrary OS commands on the Jenkins controller, potentially leading to remote code execution. It can result in unauthorized access, data breaches, and compromise of the entire Jenkins environment.
You can use the Vulert Playground at Vulert Scanner to check if your Jenkins instance is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file, without requiring access to the code or installation.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability. However, given the severity and potential impact, it is crucial to apply the recommended fixes and security updates as soon as possible.
While upgrading the plugin is the recommended solution, you can temporarily mitigate the risk by disabling or restricting access to the plugin's HTTP endpoints. However, this workaround may impact the functionality of the plugin and is not a long-term solution.
For more information about this vulnerability, you can refer to the GitHub Security Advisory GHSA-rp4x-xpgf-4xv7 at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-rp4x-xpgf-4xv7/GHSA-rp4x-xpgf-4xv7.json
