CVE-2020-2287: Audit Trail Plugin Request Logging Bypass in Jenkins
Summary
CVE-2020-2287: Request logging bypass in Jenkins Audit Trail Plugin. Affects org.jenkins-ci.plugins:audit-trail versions < 3.7. Fixed in 3.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Audit Trail Plugin is a Jenkins plugin that logs requests whose URL path matches an admin-configured regular expression. It is designed to provide an audit trail of user actions within the Jenkins environment. The plugin is an integral part of Jenkins, an open-source automation server that facilitates continuous integration and delivery of software projects. The vulnerability affects Audit Trail Plugin versions 3.6 and earlier, and Jenkins versions 2.227 and earlier, as well as LTS versions 2.204.5 and earlier.
Vulnerability Detail
The vulnerability in the Audit Trail Plugin allows attackers to bypass request logging by exploiting a discrepancy between the plugin's behavior and the Stapler web framework's parsing of URL paths. By crafting URLs that exploit this discrepancy, attackers can evade request logging in Audit Trail Plugin versions 3.6 and earlier. However, it's important to note that the fix for SECURITY-1774, which prohibits the dispatch of affected requests, mitigates this vulnerability in Jenkins versions 2.227 and earlier, as well as LTS versions 2.204.5 and earlier. Audit Trail Plugin version 3.7 addresses this issue by processing request URL paths in the same way as the Stapler web framework.
How To Fix
Minimum fixed version
3.7
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading the Audit Trail Plugin and Jenkins as mentioned in the 'how_to_fix' section.
Conclusion
The Audit Trail Plugin vulnerability allows attackers to bypass request logging, potentially compromising the integrity of the audit trail in Jenkins. To mitigate this vulnerability, it is crucial to upgrade to Audit Trail Plugin version 3.7 or later, and Jenkins version 2.228 or later (or LTS version 2.204.6 or later). For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:audit-trail →
FAQ
The vulnerability allows attackers to bypass request logging in the Audit Trail Plugin, potentially compromising the integrity of the audit trail and hindering the ability to track user actions within the Jenkins environment.
Versions 3.6 and earlier of the Audit Trail Plugin are affected.
Jenkins versions 2.227 and earlier, as well as LTS versions 2.204.5 and earlier, are affected.
Yes, upgrading to Audit Trail Plugin version 3.7 or later, and Jenkins version 2.228 or later (or LTS version 2.204.6 or later) will fix this vulnerability.
No, there are no known workarounds. It is recommended to apply the fix by upgrading the Audit Trail Plugin and Jenkins.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:audit-trail.
