CVE-2023-40349: Jenkins Gogs Plugin Unsafe Default Behavior and Information Disclosure
Summary
CVE-2023-40349: Jenkins Gogs Plugin vulnerable to unsafe default behavior and information disclosure. Affects org.jenkins-ci.plugins:gogs-webhook versions < 1.0.15. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins Gogs Plugin is a plugin for the Jenkins automation server that provides a webhook endpoint at /gogs-webhook. This endpoint allows users to trigger builds of jobs in response to events from the Gogs Git service. The plugin offers an option to specify a Gogs secret for the webhook, but this option is not enabled by default. The plugin is vulnerable to unsafe default behavior and information disclosure.
Vulnerability Detail
The vulnerability in the Jenkins Gogs Plugin allows unauthenticated attackers to trigger builds of jobs by exploiting the default behavior of the webhook endpoint. Attackers can specify the job name and initiate a build, even if they do not have the necessary permissions. Additionally, the output of the webhook endpoint reveals whether a job corresponding to the specified name exists, even if the attacker lacks permission to access it. This vulnerability poses a moderate risk and has a CVSS score of 6.5.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can manually enable the Gogs secret option for the webhook endpoint in the Jenkins Gogs Plugin configuration. By specifying a secret, the plugin will require authentication for triggering builds, mitigating the risk of unauthorized access. Here is an example of how to enable the secret option in the plugin's configuration file:
[gogs-webhook] secret = <your_secret>
Conclusion
The Jenkins Gogs Plugin is vulnerable to unsafe default behavior and information disclosure, allowing unauthenticated attackers to trigger builds of jobs and obtain information about job existence. While there is no fix currently available, it is crucial to monitor the official repositories for updates and apply any patches or fixes as soon as they are released. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:gogs-webhook →
FAQ
The vulnerability allows unauthenticated attackers to trigger builds of jobs and obtain information about job existence, potentially leading to unauthorized access and data leakage.
No, the default behavior of the Jenkins Gogs Plugin allows unauthenticated access to the webhook endpoint, enabling attackers to trigger builds without authentication.
The vulnerability affects Gogs Plugin versions 1.0.15 and earlier. It is recommended to update to the latest version once a fix is released.
As of the publication of this advisory, there is no fix available. It is advised to monitor the official repositories for updates and apply any patches or fixes as soon as they are released.
At present, there are no known alternative plugins or solutions specifically addressing this vulnerability. It is recommended to follow best practices for securing Jenkins and regularly update all installed plugins.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:gogs-webhook.
