CVE-2021-21631: Missing permission check in Jenkins Cloud Statistics Plugin
Summary
CVE-2021-21631: Missing permission check in Jenkins Cloud Statistics Plugin. Affects org.jenkins-ci.plugins:cloud-stats versions < 0.27. Fixed in 0.27. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Cloud Statistics Plugin is a Maven package (org.jenkins-ci.plugins:cloud-stats) that provides functionality for collecting and analyzing statistics related to cloud provisioning in Jenkins. It allows users to monitor and manage the provisioning of cloud resources. The plugin is commonly used in Jenkins instances that utilize cloud-based infrastructure for their build and deployment processes.
Vulnerability Detail
The Cloud Statistics Plugin version 0.26 and earlier has a vulnerability that allows attackers with Overall/Read permission and knowledge of random activity IDs to view provisioning exception error messages. This vulnerability arises from the lack of a permission check in an HTTP endpoint. By exploiting this vulnerability, an attacker can gain unauthorized access to provisioning exception error messages, potentially exposing sensitive information. The issue has been addressed in version 0.27 of the plugin, which now requires Overall/Administer permission to access provisioning exception error messages.
How To Fix
Minimum fixed version
0.27
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the vulnerable HTTP endpoint by modifying the Jenkins configuration. This can be achieved by configuring the access control rules to deny access to the endpoint for users with Overall/Read permission. The following code snippet demonstrates how to achieve this:
<authorizationStrategy class="hudson.security.FullControlOnceLoggedInAuthorizationStrategy">
<denyAnonymousReadAccess>true</denyAnonymousReadAccess>
<!-- Add additional access control rules here -->
</authorizationStrategy>
Please note that this workaround may have implications on the overall functionality of the Cloud Statistics Plugin and should be considered temporary until the plugin is updated to a secure version.
Conclusion
The Cloud Statistics Plugin version 0.26 and earlier in Jenkins is vulnerable to unauthorized access of provisioning exception error messages. Upgrading to version 0.27 or later and ensuring appropriate permissions are assigned is the recommended solution. Vulert's playground (https://vulert.com/scanner) can be used to check if your Jenkins instance is affected by this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:cloud-stats →
FAQ
This vulnerability allows attackers with Overall/Read permission to view provisioning exception error messages, potentially exposing sensitive information related to cloud provisioning in Jenkins.
Users of Jenkins instances that have the Cloud Statistics Plugin version 0.26 or earlier installed are affected by this vulnerability.
There is no known exploit for this vulnerability at the time of this advisory. However, it is recommended to apply the necessary fixes to mitigate the risk.
The CVSS score of this vulnerability is 3.1, indicating a low severity level.
You can use Vulert's playground (https://vulert.com/scanner) to check if your Jenkins instance is affected by this vulnerability. Vulert analyzes the pom.xml file of your project and provides real-time alerts for open-source vulnerabilities.
