CVE-2023-46654: Jenkins CloudBees CD Plugin Arbitrary File Deletion
Summary
CVE-2023-46654: Jenkins CloudBees CD Plugin vulnerable to arbitrary file deletion. Affects org.jenkins-ci.plugins:electricflow versions < 1.1.33. Fixed in 1.1.33. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins CloudBees CD Plugin is a Maven package (org.jenkins-ci.plugins:electricflow) that provides functionality for integrating CloudBees CD with Jenkins. It allows users to configure jobs to publish artifacts to CloudBees CD as a post-build step. This plugin is widely used in Jenkins environments to automate the deployment process and streamline the continuous delivery pipeline.
Vulnerability Detail
Jenkins CloudBees CD Plugin version 1.1.32 and earlier is vulnerable to arbitrary file deletion. During the cleanup process of the 'CloudBees CD - Publish Artifact' post-build step, the plugin follows symbolic links to locations outside of the expected directory. This allows attackers with the ability to configure jobs to delete arbitrary files on the Jenkins controller file system. The vulnerability is rated as HIGH severity and has been assigned CVE-2023-46654. It is classified under CWE-22, which refers to the improper handling of symbolic links.
How To Fix
Minimum fixed version
1.1.33
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to the latest version of the Jenkins CloudBees CD Plugin.
Conclusion
The Jenkins CloudBees CD Plugin version 1.1.32 and earlier is vulnerable to arbitrary file deletion, which can be exploited by attackers with job configuration access. To mitigate this vulnerability, users should upgrade to version 1.1.33 or later of the plugin. It is recommended to regularly monitor for vulnerabilities in open-source software using tools like Vulert. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:electricflow →
FAQ
This vulnerability allows attackers with job configuration access to delete arbitrary files on the Jenkins controller file system. This can lead to data loss, disruption of the CI/CD pipeline, and potential compromise of the Jenkins environment.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins environment is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file as input.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability. However, it is important to apply the fix promptly to mitigate the risk of potential attacks.
No, a CVSS score has not been provided for this vulnerability at the moment.
You can find more information about the Jenkins CloudBees CD Plugin on the official Jenkins website or the plugin's documentation page.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:electricflow.
