CVE-2022-20619: Cross-Site Request Forgery in Jenkins Bitbucket Branch Source Plugin
Summary
CVE-2022-20619: Cross-Site Request Forgery in Jenkins Bitbucket Branch Source Plugin. Affects org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source across 4 version ranges.
< 2.9.7.2
>= 2.9.8, < 2.9.11.2
>= 720.vbe985dd73d66, < 725.vd9f8be0fa250
>= 726.v7e6f53de133c, < 746.v350d2781c184
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Bitbucket Branch Source Plugin is a plugin for the Jenkins automation server that allows users to create Jenkins jobs directly from Bitbucket repositories. It provides integration with Bitbucket's branch source functionality, allowing Jenkins to automatically create and manage jobs for each branch in a Bitbucket repository. This plugin is widely used by developers and organizations to automate their build and deployment processes.
Vulnerability Detail
The Jenkins Bitbucket Branch Source Plugin prior to versions 746.v350d2781c184, 725.vd9f8be0fa250, 2.9.11.2, and 2.9.7.2 is vulnerable to a cross-site request forgery (CSRF) attack. This vulnerability arises from the plugin not requiring POST requests for an HTTP endpoint, allowing an attacker to forge requests on behalf of a user with Overall/Read access. By exploiting this vulnerability, an attacker can connect to a URL of their choice using credentials obtained through another method, potentially capturing sensitive information stored in Jenkins.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.9.7.22.9.7.2 -
>= 2.9.8, < 2.9.11.22.9.11.2 -
>= 720.vbe985dd73d66, < 725.vd9f8be0fa250725.vd9f8be0fa250 -
>= 726.v7e6f53de133c, < 746.v350d2781c184746.v350d2781c184
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the plugin to the fixed versions as soon as possible.
Conclusion
The Jenkins Bitbucket Branch Source Plugin is vulnerable to a cross-site request forgery (CSRF) attack, allowing attackers to perform actions on behalf of users with Overall/Read access. To mitigate this vulnerability, it is crucial to update the plugin to the fixed versions. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source →
FAQ
This vulnerability allows an attacker to perform actions on behalf of a user with Overall/Read access, potentially leading to unauthorized access to sensitive information stored in Jenkins.
You can use the Vulert Playground at Vulert Scanner to check if your Jenkins installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file for analysis.
There are currently no known public exploits for this vulnerability. However, it is crucial to update the plugin to the fixed versions to prevent potential exploitation.
Yes, this vulnerability can be exploited remotely by an attacker with Overall/Read access to the Jenkins instance.
There is no evidence of active exploitation of this vulnerability at the moment. However, it is recommended to update the plugin to the fixed versions as a precautionary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source.
