CVE-2020-2321: CSRF vulnerability in Jenkins Shelve Project Plugin
Summary
CVE-2020-2321: CSRF vulnerability in Jenkins Shelve Project Plugin. Affects org.jenkins-ci.plugins:shelve-project-plugin versions < 3.1. Fixed in 3.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Shelve Project Plugin is a Maven package that provides functionality for shelving and unshelving projects in Jenkins. It allows users to temporarily archive a project and later restore it. The plugin is commonly used in Jenkins environments to manage project workflows and facilitate collaboration among team members. However, versions 3.0 and earlier of the plugin are vulnerable to cross-site request forgery (CSRF) attacks.
Vulnerability Detail
The CSRF vulnerability in the Shelve Project Plugin allows attackers to perform unauthorized actions on a Jenkins instance. By exploiting this vulnerability, an attacker can shelve, unshelve, or delete a project without proper authorization. This can lead to disruption of project workflows, unauthorized access to sensitive information, and potential data loss. The vulnerability arises from the plugin's failure to enforce the use of POST requests for certain HTTP endpoints.
How To Fix
Minimum fixed version
3.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to version 3.1 is not immediately feasible, users can implement a workaround by manually enforcing the use of POST requests for the affected HTTP endpoints. This can be achieved by modifying the plugin's source code or by using a reverse proxy to intercept and modify the requests. However, it is strongly advised to upgrade to the latest version as soon as possible.
Conclusion
The CSRF vulnerability in the Jenkins Shelve Project Plugin can have serious consequences for Jenkins instances, including disruption of workflows and potential data loss. It is crucial to promptly upgrade to version 3.1 or later of the plugin to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:shelve-project-plugin →
FAQ
The vulnerability allows attackers to perform unauthorized actions on a Jenkins instance, potentially disrupting project workflows, gaining unauthorized access to sensitive information, and causing data loss.
You can use the Vulert Playground at Vulert Scanner to check if your Jenkins instance is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for any open-source vulnerabilities, including this CSRF vulnerability.
At the time of this report, there are no known public exploits for this vulnerability. However, it is important to promptly address and fix the vulnerability to prevent potential attacks.
Yes, a patch is available in version 3.1 of the Shelve Project Plugin. It is recommended to upgrade to this version or later to mitigate the CSRF vulnerability.
While upgrading to the latest version is the best solution, you can apply a temporary workaround by manually enforcing the use of POST requests for the affected HTTP endpoints. However, this should only be considered a temporary measure, and upgrading to the patched version is strongly advised.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:shelve-project-plugin.
