CVE-2021-43578: Agent-to-controller security bypass in Jenkins Squash TM Publisher (Squash4Jenkins) Plugin allows writing arbitrary files
Summary
CVE-2021-43578: Jenkins Squash TM Publisher (Squash4Jenkins) Plugin 1.0.0 and earlier implements an agent-to-controller message that does not implement any validation of its input, allowing attackers able to control agent processes to r... Affects org.jenkins-ci.plugins:squashtm-publisher-plugin versions < 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Squash TM Publisher (Squash4Jenkins) Plugin is a plugin for the Jenkins automation server that enables integration with the Squash Test Management tool. It provides functionality to publish test results from Jenkins to Squash. The plugin allows users to configure the integration between Jenkins and Squash, specifying the Squash server URL, project, and other settings. This plugin is commonly used in software development and testing workflows to streamline the management of test results.
Vulnerability Detail
The Jenkins Squash TM Publisher (Squash4Jenkins) Plugin version 1.0.0 and earlier contains a security bypass vulnerability that can be exploited by attackers with control over agent processes. The plugin implements an agent-to-controller message that lacks input validation, enabling attackers to replace arbitrary files on the Jenkins controller file system with a JSON string under their control. This vulnerability poses a significant risk as it allows attackers to manipulate critical files on the Jenkins controller, potentially leading to unauthorized access, data loss, or system compromise.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable or remove the Jenkins Squash TM Publisher (Squash4Jenkins) Plugin if it is not essential for their workflows. This will eliminate the risk associated with the vulnerability. However, this workaround may impact the integration between Jenkins and Squash, and users should consider the implications before taking this action.
Conclusion
The Jenkins Squash TM Publisher (Squash4Jenkins) Plugin version 1.0.0 and earlier is vulnerable to an agent-to-controller security bypass issue that allows attackers to replace arbitrary files on the Jenkins controller file system. To mitigate this risk, users should upgrade to version 1.0.1 or later of the plugin. Disabling or removing the plugin can be used as a temporary workaround. For more information and assistance, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:squashtm-publisher-plugin →
FAQ
This vulnerability allows attackers with control over agent processes to replace arbitrary files on the Jenkins controller file system, potentially leading to unauthorized access, data loss, or system compromise.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file to detect vulnerabilities.
Yes, the developers of the Jenkins Squash TM Publisher (Squash4Jenkins) Plugin have released a fixed version (1.0.1) that addresses this vulnerability. It is recommended to update to this version or a later one to mitigate the risk.
Yes, disabling or removing the Jenkins Squash TM Publisher (Squash4Jenkins) Plugin can be used as a temporary workaround to eliminate the risk associated with this vulnerability. However, consider the impact on the integration between Jenkins and Squash before taking this action.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide guidance and assistance in addressing this vulnerability in your Jenkins installation.
