CVE-2023-24435: Missing permission checks in Jenkins GitHub Pull Request Builder Plugin
Summary
CVE-2023-24435: Missing permission checks in Jenkins GitHub Pull Request Builder Plugin. Affects org.jenkins-ci.plugins:ghprb versions < 1.42.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins GitHub Pull Request Builder Plugin is a plugin for the Jenkins automation server that allows users to build GitHub pull requests. It provides integration with GitHub and enables Jenkins to automatically build and test pull requests. The plugin is widely used in software development teams to streamline the continuous integration and delivery process.
Vulnerability Detail
The Jenkins GitHub Pull Request Builder Plugin version 1.42.2 and earlier is affected by a vulnerability that allows attackers with Overall/Read permission to connect to a URL of their choice using credentials IDs obtained through another method. This vulnerability can be exploited to capture credentials stored in Jenkins. The issue arises due to a missing permission check in the plugin's code.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can restrict the Overall/Read permission to trusted individuals only. By limiting access to this permission, the risk of unauthorized URL connections and credential capture can be mitigated. However, this workaround may impact the functionality and collaboration capabilities of the Jenkins GitHub Pull Request Builder Plugin.
Conclusion
The Jenkins GitHub Pull Request Builder Plugin version 1.42.2 and earlier is vulnerable to unauthorized URL connections and credential capture. To mitigate this risk, it is crucial to upgrade to the latest version of the plugin (1.42.3 or later) and apply the necessary permission checks. Restricting the Overall/Read permission can serve as a temporary workaround, but it is recommended to update the plugin for full security. For further assistance, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:ghprb →
FAQ
This vulnerability allows attackers with Overall/Read permission to connect to arbitrary URLs and capture credentials stored in Jenkins. It can lead to unauthorized access to sensitive information and potential compromise of the Jenkins environment.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins environment is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, and you can verify the impact without any signup or installation.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is crucial to apply the recommended fix to prevent potential exploitation.
As a temporary measure, you can restrict the Overall/Read permission to trusted individuals only. This can help mitigate the risk of unauthorized access. However, it is strongly recommended to update the plugin to the latest version as soon as possible.
For further support on vulnerability remediation and securing your Jenkins environment, you can reach out to info@devnack.com. The DevNack team specializes in Jenkins security and can provide expert guidance.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:ghprb.
