CVE-2020-2235: CSRF vulnerability in Jenkins Pipeline Maven Integration Plugin allow capturing credentials
Summary
CVE-2020-2235: CSRF vulnerability in Jenkins Pipeline Maven Integration Plugin allow capturing credentials. Affects org.jenkins-ci.plugins:pipeline-maven versions < 3.8.3. Fixed in 3.8.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Jenkins Pipeline Maven Integration Plugin is a plugin for Jenkins, an open-source automation server. It provides integration between Jenkins and Maven, a build automation tool used primarily for Java projects. The plugin allows users to define and execute Maven-based pipelines within Jenkins. It is widely used in software development and continuous integration workflows.
Vulnerability Detail
The Pipeline Maven Integration Plugin version 3.8.2 and earlier is vulnerable to a cross-site request forgery (CSRF) attack. The plugin does not perform a permission check in a method implementing form validation. This allows users with Overall/Read access to Jenkins to connect to an attacker-specified JDBC URL using attacker-specified credentials IDs obtained through another method. As a result, the attacker can potentially capture credentials stored in Jenkins. Additionally, the form validation method does not require POST requests, further exposing the vulnerability to CSRF attacks.
How To Fix
Minimum fixed version
3.8.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to version 3.8.3 is not immediately feasible, a temporary workaround is to restrict Overall/Read access to Jenkins to trusted users only. This can be done by adjusting the access control settings in Jenkins. Additionally, implementing CSRF protection mechanisms, such as using anti-CSRF tokens, can help mitigate the risk of CSRF attacks.
Conclusion
The CSRF vulnerability in the Jenkins Pipeline Maven Integration Plugin can lead to the capture of credentials stored in Jenkins, potentially resulting in unauthorized access to sensitive information or systems. It is crucial to upgrade to version 3.8.3 of the plugin or apply the recommended mitigations to protect against this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:pipeline-maven →
FAQ
This vulnerability allows an attacker to capture credentials stored in Jenkins, potentially leading to unauthorized access to sensitive information or systems.
Users of Jenkins who have the Pipeline Maven Integration Plugin version 3.8.2 or earlier installed are affected by this vulnerability.
While there is no known public exploit for this vulnerability, it is important to apply the recommended fixes to prevent potential attacks.
Upgrading to version 3.8.3 of the Pipeline Maven Integration Plugin is the recommended mitigation. Restricting Overall/Read access to trusted users and implementing CSRF protection mechanisms can also help mitigate the risk.
You can find more information about this vulnerability in the GitHub Security Advisory database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-c2hg-2jj6-h8vh/GHSA-c2hg-2jj6-h8vh.json
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:pipeline-maven.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
