CVE-2023-24438: Missing permissions check in Jenkins JIRA Pipeline Steps Plugin
Summary
CVE-2023-24438: Missing permissions check in Jenkins JIRA Pipeline Steps Plugin. Affects org.jenkins-ci.plugins:jira-steps versions < 2.0.165.v8846cf59f3db. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins JIRA Pipeline Steps Plugin is a Maven-based package that provides integration between Jenkins and JIRA, allowing users to perform various JIRA-related tasks within Jenkins pipelines. It enables seamless communication and interaction between the two platforms, enhancing the automation capabilities of Jenkins. However, a vulnerability has been identified in versions up to 2.0.165.v8846cf59f3db of the plugin.
Vulnerability Detail
The vulnerability in the Jenkins JIRA Pipeline Steps Plugin allows attackers with Overall/Read permission to connect to a specified URL using attacker-specified credentials IDs obtained through another method. This can lead to the capture of credentials stored in Jenkins, potentially exposing sensitive information. The issue stems from a missing permission check, which enables unauthorized access to the plugin's functionality.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can restrict the permissions of users with Overall/Read permission to mitigate the risk of unauthorized access. By limiting the number of users with this permission level, the potential attack surface is reduced. Additionally, it is advisable to regularly monitor and review the access permissions of users within the Jenkins environment.
Conclusion
The Jenkins JIRA Pipeline Steps Plugin is vulnerable to a missing permissions check, allowing attackers with Overall/Read permission to connect to a specified URL and potentially capture sensitive credentials. It is crucial to upgrade to a non-affected version of the plugin and regularly review access permissions to mitigate the risk. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:jira-steps →
FAQ
The vulnerability allows attackers with Overall/Read permission to connect to a specified URL using attacker-specified credentials IDs, potentially capturing sensitive credentials stored in Jenkins.
You can use the Vulert Playground at Vulert Scanner to check if your Jenkins installation is affected by this vulnerability. Simply enter your pom.xml file and the playground will provide real-time alerts for open-source vulnerabilities.
Yes, a fix is available for this vulnerability. It is recommended to upgrade to a version of the Jenkins JIRA Pipeline Steps Plugin that is not affected by this issue.
Yes, as a temporary workaround, you can restrict the permissions of users with Overall/Read permission to reduce the potential attack surface.
For more information about this vulnerability, you can refer to the GitHub Security Advisory GHSA-6j27-3xfw-cj2w at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/01/GHSA-6j27-3xfw-cj2w/GHSA-6j27-3xfw-cj2w.json
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:jira-steps.
