CVE-2023-43501: Jenkins Build Failure Analyzer Plugin Missing Permission Check
Summary
CVE-2023-43501: Jenkins Build Failure Analyzer Plugin missing permission check. Affects com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer versions < 2.4.2. Fixed in 2.4.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Build Failure Analyzer Plugin is a Maven-based package that provides functionality for analyzing build failures in Jenkins. It helps identify the root cause of build failures by analyzing the console output and providing actionable insights. The plugin is widely used in Jenkins environments to improve build stability and efficiency. However, versions 2.4.1 and earlier of the plugin suffer from a vulnerability that allows attackers with Overall/Read permission to connect to a specified hostname and port using an attacker-specified username and password. This vulnerability also exposes a cross-site request forgery (CSRF) vulnerability due to the lack of POST request requirement.
Vulnerability Detail
The vulnerability in the Jenkins Build Failure Analyzer Plugin arises from the absence of a permission check in a connection test HTTP endpoint. This allows attackers with Overall/Read permission to connect to an attacker-specified hostname and port using an attacker-specified username and password. As a result, an attacker can potentially gain unauthorized access to sensitive information or perform malicious actions on the affected Jenkins instance. Additionally, the lack of POST request requirement in the HTTP endpoint exposes a CSRF vulnerability, enabling attackers to forge requests and perform actions on behalf of authenticated users.
How To Fix
Minimum fixed version
2.4.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the affected HTTP endpoint by modifying the Jenkins configuration or implementing network-level controls. This can involve blocking access to the endpoint from unauthorized sources or limiting access to trusted networks only. However, applying the workaround is not a permanent solution, and upgrading to the fixed version is strongly advised.
Conclusion
The Jenkins Build Failure Analyzer Plugin versions 2.4.1 and earlier suffer from a vulnerability that allows attackers with Overall/Read permission to connect to a specified hostname and port using an attacker-specified username and password. This can lead to unauthorized access and potential malicious actions. Upgrading to version 2.4.2 or later of the plugin is recommended to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer →
FAQ
The vulnerability allows attackers with Overall/Read permission to connect to a specified hostname and port using an attacker-specified username and password. This can lead to unauthorized access to sensitive information or malicious actions on the affected Jenkins instance.
Yes, the attacker needs to have Overall/Read permission and provide valid credentials to exploit this vulnerability.
There are no known instances of this vulnerability being exploited in the wild at this time.
Yes, this vulnerability can be exploited remotely if the attacker has Overall/Read permission and can connect to the affected HTTP endpoint.
Yes, the CVSS score for this vulnerability is 4.3 (Moderate).
Related vulnerabilities
Recent vulnerabilities recorded for com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer.
