CVE-2023-24437: Cross-site request forgery vulnerability in Jenkins JIRA Pipeline Steps Plugin
Summary
CVE-2023-24437: Cross-site request forgery vulnerability in Jenkins JIRA Pipeline Steps Plugin. Affects org.jenkins-ci.plugins:jira-steps versions < 2.0.165.v8846cf59f3db. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins JIRA Pipeline Steps Plugin is a Maven package that provides integration between Jenkins and JIRA, allowing users to perform various JIRA-related actions within Jenkins pipelines. It enables developers to automate JIRA issue creation, updates, and other operations as part of their CI/CD workflows. This plugin is widely used in Jenkins environments to streamline the development process and enhance collaboration between development and issue tracking teams.
Vulnerability Detail
A cross-site request forgery (CSRF) vulnerability has been identified in the Jenkins JIRA Pipeline Steps Plugin version 2.0.165.v8846cf59f3db and earlier. This vulnerability allows attackers to exploit the plugin's lack of CSRF protection and connect to a URL of their choice using credentials IDs obtained through another method. By capturing credentials stored in Jenkins, an attacker can potentially gain unauthorized access to sensitive information or perform malicious actions within the Jenkins environment.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable or remove the Jenkins JIRA Pipeline Steps Plugin from their Jenkins installation until the vulnerability is fixed. This can be done by navigating to the Jenkins plugin management interface, locating the JIRA Pipeline Steps Plugin, and disabling or uninstalling it. However, this workaround may impact the functionality of pipelines that rely on this plugin.
Conclusion
The Jenkins JIRA Pipeline Steps Plugin is affected by a CSRF vulnerability that allows attackers to connect to an attacker-specified URL using stolen credentials. To mitigate this risk, it is crucial to update the plugin to version 2.0.166 or later. Alternatively, users can temporarily disable or remove the plugin until the fix is applied. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:jira-steps →
FAQ
This vulnerability allows attackers to connect to an attacker-specified URL using stolen credentials, potentially leading to unauthorized access to sensitive information or malicious actions within the Jenkins environment.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins installation is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this CSRF vulnerability.
Yes, a fix for this vulnerability is available in version 2.0.166 or later of the Jenkins JIRA Pipeline Steps Plugin. It is recommended to update your Jenkins installation to include the latest version of the plugin to mitigate the risk.
Yes, as a temporary workaround, you can disable or remove the Jenkins JIRA Pipeline Steps Plugin from your Jenkins installation until the vulnerability is fixed. However, this may impact the functionality of pipelines that rely on this plugin.
For more information about this vulnerability, you can refer to the GitHub Security Advisory GHSA-r3gm-jwf4-xgv2 (https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/01/GHSA-r3gm-jwf4-xgv2/GHSA-r3gm-jwf4-xgv2.json).
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:jira-steps.
