CVE-2023-43500: Jenkins Build Failure Analyzer Plugin Cross-Site Request Forgery vulnerability
Summary
CVE-2023-43500: Jenkins Build Failure Analyzer Plugin Cross-Site Request Forgery vulnerability. Affects com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer versions < 2.4.2. Fixed in 2.4.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Build Failure Analyzer Plugin is a Maven ecosystem package developed by com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer. It is designed to analyze build failures in Jenkins, a popular open-source automation server. The plugin helps identify the root causes of build failures and provides insights for troubleshooting and resolving issues.
Vulnerability Detail
The Jenkins Build Failure Analyzer Plugin version 2.4.1 and earlier is affected by a Cross-Site Request Forgery (CSRF) vulnerability. This vulnerability arises due to the plugin's failure to perform a permission check in a connection test HTTP endpoint. Attackers with Overall/Read permission can exploit this vulnerability to connect to a specified hostname and port using an attacker-specified username and password. The HTTP endpoint also does not require POST requests, further exacerbating the CSRF vulnerability. The impact of this vulnerability includes unauthorized access to sensitive information and potential manipulation of Jenkins build processes.
How To Fix
Minimum fixed version
2.4.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is crucial to upgrade to the fixed version (2.4.2) as soon as possible.
Conclusion
The Jenkins Build Failure Analyzer Plugin version 2.4.1 and earlier is vulnerable to a Cross-Site Request Forgery (CSRF) attack. To mitigate this vulnerability, it is crucial to upgrade to version 2.4.2 of the plugin. This version introduces the necessary security measures to prevent unauthorized access and potential manipulation of Jenkins build processes. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer →
FAQ
The vulnerability allows attackers with Overall/Read permission to connect to a specified hostname and port using an attacker-specified username and password. This can lead to unauthorized access to sensitive information and potential manipulation of Jenkins build processes.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins instance is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is essential to apply the recommended fix to prevent any potential exploitation.
No, the recommended fix for this vulnerability is to upgrade to version 2.4.2 of the Build Failure Analyzer Plugin. This version includes the necessary security enhancements to mitigate the CSRF vulnerability.
This vulnerability was identified and reported by the GitHub Security Lab.
Related vulnerabilities
Recent vulnerabilities recorded for com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer.
