CVE-2020-2240: CSRF vulnerability in Jenkins Database Plugin
Summary
CVE-2020-2240: CSRF vulnerability in Jenkins Database Plugin. Affects org.jenkins-ci.plugins:database versions < 1.7. Fixed in 1.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Database Plugin is a Maven package that provides functionality for managing databases within Jenkins. It allows users to execute SQL scripts and interact with databases through a web-based console. The plugin version 1.6 and earlier do not enforce the use of POST requests for the database console, making it vulnerable to cross-site request forgery (CSRF) attacks. This vulnerability can be exploited by attackers to execute arbitrary SQL scripts, potentially leading to unauthorized access, data manipulation, or data leakage. The issue has been addressed in version 1.7 of the plugin, which removes the database console.
Vulnerability Detail
The CSRF vulnerability in the Jenkins Database Plugin arises from the lack of enforcement of POST requests for the database console. This allows an attacker to trick a logged-in user into performing unintended actions on the database by crafting a malicious request. By exploiting this vulnerability, an attacker can execute arbitrary SQL scripts, potentially compromising the integrity and confidentiality of the database. The impact of this vulnerability is rated as HIGH with a CVSS score of 8.8.
How To Fix
Minimum fixed version
1.7
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading the plugin is not immediately feasible, a temporary workaround is to disable or restrict access to the database console. This can be done by modifying the Jenkins configuration or access control settings to prevent unauthorized access to the vulnerable functionality. However, it is strongly advised to update to the latest version of the plugin as soon as possible.
Conclusion
The CSRF vulnerability in the Jenkins Database Plugin (CVE-2020-2240) allows attackers to execute arbitrary SQL scripts, potentially compromising the integrity and confidentiality of the database. It is crucial to update the plugin to version 1.7 or later to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:database →
FAQ
The vulnerability allows attackers to execute arbitrary SQL scripts, potentially leading to unauthorized access, data manipulation, or data leakage.
To fix the vulnerability, update the Jenkins Database Plugin to version 1.7 or later.
A temporary workaround is to disable or restrict access to the database console until the plugin can be updated.
There are no known public exploits for this vulnerability at the time of this advisory.
For more information, refer to the GitHub advisory at: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-jf9j-hx2j-m9xh/GHSA-jf9j-hx2j-m9xh.json
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:database.
