CVE-2020-2323: Missing permission checks in Jenkins Chaos Monkey Plugin
Summary
CVE-2020-2323: Missing permission checks in Jenkins Chaos Monkey Plugin. Affects io.jenkins.plugins:chaos-monkey versions < 0.4.1. Fixed in 0.4.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Chaos Monkey Plugin is a tool used for introducing controlled chaos into a Jenkins environment to test its resilience. It allows users to simulate failures and disruptions to identify and fix potential weaknesses. The plugin provides an HTTP endpoint that can be accessed to perform these actions. However, versions 0.4 and earlier of the plugin do not enforce permission checks on this endpoint, allowing attackers with Overall/Read permission to access the Chaos Monkey page and view the history of actions.
Vulnerability Detail
The vulnerability (CVE-2020-2323) in the Jenkins Chaos Monkey Plugin arises from the lack of permission checks in the HTTP endpoint. This means that any user with Overall/Read permission can access the Chaos Monkey page and view the history of actions. This can lead to unauthorized access and potential misuse of the Chaos Monkey functionality. The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
How To Fix
Minimum fixed version
0.4.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the fixed version of the Chaos Monkey Plugin.
Conclusion
The Jenkins Chaos Monkey Plugin versions 0.4 and earlier are vulnerable to unauthorized access due to missing permission checks in the HTTP endpoint. To mitigate this vulnerability, it is crucial to upgrade to version 0.4.1 or later of the plugin, which enforces the necessary permission checks. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for io.jenkins.plugins:chaos-monkey →
FAQ
The vulnerability allows attackers with Overall/Read permission to access the Chaos Monkey page and view the history of actions. This can lead to unauthorized access and potential misuse of the Chaos Monkey functionality.
The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
To fix this vulnerability, it is recommended to upgrade to version 0.4.1 or later of the Chaos Monkey Plugin.
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the fixed version of the Chaos Monkey Plugin.
For more information about this vulnerability, you can refer to the CVE-2020-2323 advisory or the GitHub advisory database.
Related vulnerabilities
Recent vulnerabilities recorded for io.jenkins.plugins:chaos-monkey.
