CVE-2023-49652: Jenkins Google Compute Engine Plugin Incorrect Permission Checks
Summary
CVE-2023-49652: Jenkins Google Compute Engine Plugin has incorrect permission checks. Affects org.jenkins-ci.plugins:google-compute-engine across 2 version ranges.
< 4.3.17.1
>= 4.5, < 4.551.v5a
Fixed in 4.3.17.1 or 4.551.v5a, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Google Compute Engine Plugin is a Maven package (org.jenkins-ci.plugins:google-compute-engine) that provides integration between Jenkins and Google Cloud Platform's Compute Engine. It allows users to dynamically provision Jenkins agents on Google Compute Engine instances. This plugin is widely used by organizations to automate their build and deployment processes on the cloud infrastructure.
Vulnerability Detail
The Jenkins Google Compute Engine Plugin versions 4.550.vb_327fca_3db_11 and earlier have incorrect permission checks in multiple HTTP endpoints. This vulnerability allows attackers with global Item/Configure permission (while lacking Item/Configure permission on any particular job) to perform the following actions:
- Enumerate system-scoped credentials IDs of credentials stored in Jenkins. These credentials can be used in conjunction with another vulnerability to capture the credentials.
- Connect to Google Cloud Platform using attacker-specified credentials IDs obtained through another method, to obtain information about existing projects.
This vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.3.17.14.3.17.1 -
>= 4.5, < 4.551.v5a4.551.v5a
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. Upgrading to the fixed version is the recommended solution.
Conclusion
The Jenkins Google Compute Engine Plugin versions 4.550.vb_327fca_3db_11 and earlier have incorrect permission checks, allowing attackers to enumerate credentials and obtain information about projects on Google Cloud Platform. Upgrading to version 4.551.v5a or later is recommended to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:google-compute-engine →
FAQ
This vulnerability allows attackers to enumerate system-scoped credentials IDs and obtain information about existing projects on Google Cloud Platform. However, it does not directly allow unauthorized access to sensitive data or systems.
Organizations using Jenkins Google Compute Engine Plugin versions 4.550.vb_327fca_3db_11 and earlier are affected by this vulnerability.
There are no known exploits for this vulnerability at the time of this report. However, it is important to apply the recommended fix to mitigate any potential risks.
Yes, this vulnerability can be exploited remotely by attackers with global Item/Configure permission on Jenkins.
Yes, this vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:google-compute-engine.
