CVE-2020-2285: Missing permission check in Jenkins Liquibase Runner Plugin allows enumerating credentials IDs
Summary
CVE-2020-2285: Missing permission check in Jenkins Liquibase Runner Plugin allows enumerating credentials IDs. Affects org.jenkins-ci.plugins:liquibase-runner versions < 1.4.8. Fixed in 1.4.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Liquibase Runner Plugin is a Maven package that provides functionality for running Liquibase scripts as part of a Jenkins pipeline. It allows users to manage database schema changes and versioning. The plugin integrates with Jenkins and provides a convenient way to execute Liquibase commands within a Jenkins pipeline. However, versions 1.4.7 and earlier of the plugin have a vulnerability that allows attackers with Overall/Read permission to enumerate credentials IDs stored in Jenkins. This can be used as part of an attack to capture the credentials using another vulnerability.
Vulnerability Detail
The vulnerability in the Jenkins Liquibase Runner Plugin (versions 1.4.7 and earlier) is due to a missing permission check in an HTTP endpoint. This means that any user with Overall/Read permission can access the endpoint and enumerate the credentials IDs of credentials stored in Jenkins. These credentials IDs can then be used by an attacker to target and capture the credentials using another vulnerability. The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
How To Fix
Minimum fixed version
1.4.8
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the latest version of the Liquibase Runner Plugin.
Conclusion
The Jenkins Liquibase Runner Plugin versions 1.4.7 and earlier have a vulnerability that allows attackers with Overall/Read permission to enumerate credentials IDs stored in Jenkins. This can be used as part of an attack to capture the credentials using another vulnerability. To fix this vulnerability, it is recommended to upgrade to version 1.4.8 or later of the plugin. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:liquibase-runner →
FAQ
The vulnerability allows attackers with Overall/Read permission to enumerate credentials IDs stored in Jenkins. This can be used as part of an attack to capture the credentials using another vulnerability.
Users of Jenkins who have installed and are using versions 1.4.7 and earlier of the Liquibase Runner Plugin are affected by this vulnerability.
There are no known exploits for this vulnerability at the moment. However, it is important to patch the vulnerability as soon as possible to prevent any potential attacks.
Yes, a fix is available in version 1.4.8 of the Liquibase Runner Plugin. It is recommended to upgrade to this version or later to patch the vulnerability.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it and alert you if any open-source vulnerabilities, including this one, are found.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:liquibase-runner.
