CVE-2023-46655: Jenkins CloudBees CD Plugin Arbitrary File Read
Summary
CVE-2023-46655: Jenkins CloudBees CD Plugin vulnerable to arbitrary file read. Affects org.jenkins-ci.plugins:electricflow versions < 1.1.33. Fixed in 1.1.33. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Jenkins CloudBees CD Plugin is a plugin for the Jenkins automation server that integrates with the CloudBees CD (formerly ElectricFlow) server. It allows users to publish artifacts from Jenkins to the CloudBees CD server. The plugin is commonly used in CI/CD pipelines to automate the deployment of applications. However, versions 1.1.32 and earlier of the plugin are vulnerable to an arbitrary file read vulnerability.
Vulnerability Detail
The vulnerability in the Jenkins CloudBees CD Plugin allows attackers with the ability to configure jobs to publish arbitrary files from the Jenkins controller file system to the CloudBees CD server. This is possible because the plugin follows symbolic links to locations outside of the directory from which artifacts are published during the 'CloudBees CD - Publish Artifact' post-build step. By exploiting this vulnerability, an attacker could potentially access sensitive files on the Jenkins controller file system and exfiltrate them to the CloudBees CD server.
How To Fix
Minimum fixed version
1.1.33
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of the plugin is not immediately possible, users can mitigate the risk by disabling the 'CloudBees CD - Publish Artifact' post-build step in affected jobs. This will prevent the plugin from being used to publish artifacts and potentially exploit the vulnerability. However, this workaround may impact the functionality of CI/CD pipelines that rely on the plugin for artifact publishing.
Conclusion
The Jenkins CloudBees CD Plugin versions 1.1.32 and earlier are vulnerable to an arbitrary file read vulnerability. To mitigate the risk, users should upgrade to version 1.1.33 or later of the plugin. If immediate upgrade is not possible, users can disable the 'CloudBees CD - Publish Artifact' post-build step in affected jobs. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:electricflow →
FAQ
The vulnerability allows attackers to read arbitrary files from the Jenkins controller file system and publish them to the CloudBees CD server. This could potentially expose sensitive information and compromise the security of the Jenkins environment.
Users of Jenkins CloudBees CD Plugin versions 1.1.32 and earlier are affected by this vulnerability. Users who have configured jobs to publish artifacts using the plugin are particularly at risk.
There are currently no known public exploits for this vulnerability. However, it is advisable to apply the recommended fix or workaround as soon as possible to mitigate the risk.
No, this vulnerability requires an attacker to have the ability to configure jobs in Jenkins and publish artifacts using the CloudBees CD Plugin. It cannot be exploited remotely without prior access to the Jenkins environment.
Yes, this vulnerability is identified as CVE-2023-46655.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:electricflow.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
