CVE-2020-2200: OS Command Injection in Jenkins Play Framework Plugin
Summary
CVE-2020-2200: OS command injection vulnerability in Jenkins Play Framework Plugin. Affects org.jenkins-ci.plugins:play-autotest-plugin versions < 1.0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Play Framework Plugin is a Maven-based plugin that allows users to build, test, and deploy Play Framework applications. It provides integration with the Play Framework, a popular web application framework for Java and Scala. The plugin enables users to execute the play command to validate input files. However, versions 1.0.2 and earlier of the plugin are vulnerable to OS command injection.
Vulnerability Detail
The vulnerability in the Jenkins Play Framework Plugin arises from a form validation endpoint that executes the play command to validate a given input file. The plugin allows users to specify the path to the play command on the Jenkins controller. This design flaw enables users with the ability to store a file on the Jenkins controller (e.g., through archiving artifacts) to exploit the OS command injection vulnerability. An attacker could potentially execute arbitrary commands on the underlying operating system with the privileges of the Jenkins process, leading to unauthorized access, data manipulation, or system compromise.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable or restrict access to the Play Framework Plugin until the plugin is updated to a secure version. This can be achieved by removing or disabling the plugin from the Jenkins configuration. However, this workaround may impact the functionality of Play Framework applications in the Jenkins environment.
Conclusion
The OS command injection vulnerability in the Jenkins Play Framework Plugin (CVE-2020-2200) allows attackers to execute arbitrary commands on the underlying operating system. It is crucial to update the plugin to a secure version and properly configure the play command path to prevent unauthorized access. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:play-autotest-plugin →
FAQ
The vulnerability allows an attacker to execute arbitrary commands on the underlying operating system with the privileges of the Jenkins process. This can lead to unauthorized access, data manipulation, or complete compromise of the system.
Users of Jenkins Play Framework Plugin versions 1.0.2 and earlier are affected by this vulnerability.
There are currently no known public exploits for this vulnerability. However, it is advisable to apply the recommended fixes and security updates as soon as possible to mitigate the risk.
No, this vulnerability requires the ability to store a file on the Jenkins controller. Therefore, an attacker needs to have access to the Jenkins environment to exploit this vulnerability.
Yes, the CVSS score for this vulnerability is 8.8, indicating a high severity level.
