CVE-2020-2261: OS command execution vulnerability in Perfecto Plugin
Summary
CVE-2020-2261: OS command execution vulnerability in Perfecto Plugin. Affects io.jenkins.plugins:perfecto versions < 1.18. Fixed in 1.18. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Perfecto Plugin is a Maven package that provides functionality for specifying Perfecto Connect Path and Perfecto Connect File Name in Jenkins job configurations. It allows users to integrate Perfecto Connect into their Jenkins pipelines for mobile and web testing. However, versions 1.17 and earlier of the plugin are vulnerable to an OS command execution vulnerability.
Vulnerability Detail
The vulnerability in Perfecto Plugin arises from the execution of arbitrary commands on the Jenkins controller. Attackers with Job/Configure permission can exploit this vulnerability to run arbitrary commands on the Jenkins controller. This can lead to unauthorized access, data breaches, and potential compromise of the entire Jenkins environment. Perfecto Plugin version 1.18 addresses this issue by executing the specified commands on the agent the build is running on, mitigating the risk of command execution on the controller.
How To Fix
Minimum fixed version
1.18
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by upgrading to Perfecto Plugin version 1.18 or later as mentioned in the 'how_to_fix' section.
Conclusion
The OS command execution vulnerability in Perfecto Plugin (CVE-2020-2261) allows attackers to run arbitrary commands on the Jenkins controller. Upgrading to Perfecto Plugin version 1.18 or later is crucial to mitigate this vulnerability and enhance the security of the Jenkins environment. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.jenkins.plugins:perfecto →
FAQ
Perfecto Plugin is a Maven package that enables integration of Perfecto Connect into Jenkins pipelines for mobile and web testing.
This vulnerability allows attackers with Job/Configure permission to execute arbitrary commands on the Jenkins controller, potentially leading to unauthorized access, data breaches, and compromise of the Jenkins environment.
Perfecto Plugin versions up to and including 1.17 are affected by this vulnerability.
To fix this vulnerability, upgrade to Perfecto Plugin version 1.18 or later.
There is no specific workaround mentioned for this vulnerability. Upgrading to version 1.18 or later is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for io.jenkins.plugins:perfecto.
