CVE-2020-2197: Missing permission check in Jenkins Project Inheritance Plugin
Summary
CVE-2020-2197: Missing permission check in Jenkins Project Inheritance Plugin. Affects hudson.plugins:project-inheritance versions < 21.04.03. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Project Inheritance Plugin is a plugin for the Jenkins automation server that provides job inheritance capabilities. It allows users to create new jobs based on existing ones, inheriting their configuration and settings. The plugin offers various job inspection features, including an API URL for retrieving job configuration XML data. However, prior to version 21.04.03, the plugin did not properly check permissions for this API endpoint, granting access to job configuration XML data to users with Job/Read permission. This vulnerability can potentially expose sensitive information, including encrypted values of secrets stored in the job configuration.
Vulnerability Detail
The vulnerability in the Jenkins Project Inheritance Plugin (prior to version 21.04.03) allows users with Job/Read permission to access job configuration XML data without proper permission checks. This can lead to unauthorized access to sensitive information, including encrypted secrets. The plugin does not redact the encrypted values of secrets in the job configuration, unlike the config.xml API for users without Job/Configure permission. The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can restrict access to the affected API endpoint by modifying the Jenkins configuration or using access control plugins. This can involve limiting the Job/Read permission or implementing additional access restrictions for the API URL /job/<job_name>/getConfigAsXML. However, applying the recommended fix by upgrading to the latest version of the Project Inheritance Plugin is the most effective solution.
Conclusion
The Jenkins Project Inheritance Plugin prior to version 21.04.03 is vulnerable to unauthorized access of job configuration XML data. This can potentially expose sensitive information, including encrypted secrets. Users should upgrade to the latest version of the plugin to fix this vulnerability and ensure proper permission checks. Applying the recommended fix or workaround is crucial to mitigate the risk of unauthorized access. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for hudson.plugins:project-inheritance →
FAQ
The vulnerability allows users with Job/Read permission to access job configuration XML data, potentially exposing sensitive information, including encrypted secrets stored in the job configuration.
Users of Jenkins automation server with the Project Inheritance Plugin versions prior to 21.04.03 are affected by this vulnerability.
There is no known exploit for this vulnerability at the time of this advisory. However, it is recommended to apply the fix or workaround to mitigate the risk of unauthorized access.
Users can mitigate the risk by upgrading to version 21.04.03 or later of the Project Inheritance Plugin. Additionally, access to the affected API endpoint can be restricted through Jenkins configuration or access control plugins.
For more information about this vulnerability, refer to the GitHub Security Advisory GHSA-hj32-9mcw-5cwh.
References
Related vulnerabilities
Recent vulnerabilities recorded for hudson.plugins:project-inheritance.
