CVE-2020-2322: Missing permission checks in Jenkins Chaos Monkey Plugin
Summary
CVE-2020-2322: Missing permission checks in Jenkins Chaos Monkey Plugin. Affects io.jenkins.plugins:chaos-monkey versions < 0.4. Fixed in 0.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Chaos Monkey Plugin is a Maven package (io.jenkins.plugins:chaos-monkey) that introduces chaos engineering principles into Jenkins. It allows users to simulate failures and disruptions in their Jenkins environment to test its resilience. The plugin provides various features, including generating load and inducing memory leaks. However, versions 0.3 and earlier of the plugin lack proper permission checks in several HTTP endpoints, potentially enabling attackers with Overall/Read permission to exploit these functionalities.
Vulnerability Detail
The vulnerability (CVE-2020-2322) arises from the absence of permission checks in the affected Jenkins Chaos Monkey Plugin versions. Attackers with Overall/Read permission can abuse the plugin's load generation and memory leak capabilities. This can lead to the generation of excessive load on the Jenkins server, potentially impacting its performance and availability. Additionally, attackers can exploit the memory leak functionality to consume system resources and cause memory exhaustion. The vulnerability has a CVSS score of 4.3 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).
How To Fix
Minimum fixed version
0.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the affected endpoints by modifying the Jenkins configuration or using access control plugins. By limiting access to these endpoints to trusted users with Overall/Administer permission, the risk of exploitation can be reduced. However, applying the recommended fix by upgrading to version 0.4 is the most effective solution.
Conclusion
The Jenkins Chaos Monkey Plugin versions 0.3 and earlier are vulnerable to a missing permission check issue. Attackers with Overall/Read permission can exploit this vulnerability to generate excessive load and induce memory leaks. To mitigate the risk, it is recommended to upgrade to version 0.4 or later of the plugin, which introduces proper permission checks. Alternatively, restricting access to the affected endpoints can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.jenkins.plugins:chaos-monkey →
FAQ
The Jenkins Chaos Monkey Plugin is a Maven package that enables chaos engineering in Jenkins. It allows users to simulate failures and disruptions to test the resilience of their Jenkins environment.
Versions 0.3 and earlier of the Chaos Monkey Plugin are affected by this vulnerability.
Attackers with Overall/Read permission can generate excessive load on the Jenkins server and induce memory leaks, potentially impacting its performance and availability.
Attackers need Overall/Read permission to exploit the vulnerability. However, version 0.4 of the plugin requires Overall/Administer permission for load generation and memory leaks.
The vulnerability has a CVSS score of 4.3 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).
Related vulnerabilities
Recent vulnerabilities recorded for io.jenkins.plugins:chaos-monkey.
