CVE-2023-46657: Jenkins Gogs Plugin Non-Constant Time Webhook Token Comparison Vulnerability

Background

The Jenkins Gogs Plugin is a Maven package (org.jenkins-ci.plugins:gogs-webhook) that integrates Jenkins with the Gogs Git service. It allows Jenkins to receive webhook notifications from Gogs repositories, triggering build jobs in response to events such as code pushes. The plugin facilitates seamless integration between Jenkins and Gogs, enhancing the automation and CI/CD capabilities of software development workflows.

Vulnerability Detail

The Jenkins Gogs Plugin versions 1.0.15 and earlier suffer from a non-constant time webhook token comparison vulnerability. The plugin uses a comparison function that does not take a constant amount of time when checking if the provided and expected webhook tokens are equal. This can potentially enable attackers to employ statistical methods to obtain a valid webhook token. By exploiting this vulnerability, an attacker could gain unauthorized access to the Jenkins instance or manipulate the build process, leading to various security risks and potential compromise of the CI/CD pipeline.

Workaround

As a temporary workaround, users can manually modify the affected plugin's source code to implement a constant time comparison function for webhook token validation. Below is an example of the modified code:

// Original code
if (providedToken.equals(expectedToken)) {
    // Token is valid
}

// Modified code
boolean tokensMatch = true;
byte[] providedBytes = providedToken.getBytes();
byte[] expectedBytes = expectedToken.getBytes();
if (providedBytes.length != expectedBytes.length) {
    tokensMatch = false;
}
for (int i = 0; i < providedBytes.length; i++) {
    if (providedBytes[i] != expectedBytes[i]) {
        tokensMatch = false;
    }
}
if (tokensMatch) {
    // Token is valid
}

Please note that applying manual code modifications is not recommended as it can introduce additional risks and complications. It is strongly advised to update to a fixed version of the plugin instead.

Conclusion

The Jenkins Gogs Plugin versions 1.0.15 and earlier are vulnerable to a non-constant time webhook token comparison issue. This vulnerability can potentially enable attackers to obtain a valid webhook token, compromising the security and integrity of the Jenkins instance and the CI/CD pipeline. It is crucial to update the plugin to a fixed version beyond 1.0.15 or apply the provided workaround until the update can be performed. For further assistance and support in addressing this vulnerability, please contact DevNack.com.

See every vulnerability recorded for org.jenkins-ci.plugins:gogs-webhook →

FAQ