CVE-2024-28155: Jenkins AppSpider Plugin Missing Permission Checks
Summary
CVE-2024-28155: Jenkins AppSpider Plugin missing permission checks. Affects com.rapid7:jenkinsci-appspider-plugin versions < 1.0.17. Fixed in 1.0.17. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins AppSpider Plugin is a Maven package (com.rapid7:jenkinsci-appspider-plugin) that integrates the AppSpider tool into Jenkins, a popular automation server. This plugin allows users to perform security scans on their applications and obtain vulnerability reports. It provides various features such as configuring scan settings, managing engine groups, and specifying client names. However, versions 1.0.16 and earlier of the plugin suffer from a vulnerability that allows attackers with Overall/Read permission to access sensitive information without proper permission checks.
Vulnerability Detail
The vulnerability in Jenkins AppSpider Plugin 1.0.16 and earlier arises from the lack of permission checks in several HTTP endpoints. Attackers with Overall/Read permission can exploit this flaw to gather information about available scan config names, engine group names, and client names. This unauthorized access to sensitive data can potentially aid attackers in planning further attacks or gaining unauthorized access to vulnerable systems.
How To Fix
Minimum fixed version
1.0.17
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is advised to upgrade to the fixed version of the plugin as soon as possible.
Conclusion
The Jenkins AppSpider Plugin versions 1.0.16 and earlier suffer from a vulnerability that allows attackers with Overall/Read permission to access sensitive information without proper permission checks. To mitigate this issue, it is crucial to upgrade to version 1.0.17 or later of the plugin. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.rapid7:jenkinsci-appspider-plugin →
FAQ
The vulnerability allows attackers with Overall/Read permission to gather sensitive information about scan config names, engine group names, and client names. This information can be used to plan further attacks or gain unauthorized access to vulnerable systems.
Users of Jenkins AppSpider Plugin versions 1.0.16 and earlier are affected by this vulnerability.
There is no known exploit for this vulnerability at the time of this report.
The only effective mitigation is to upgrade to version 1.0.17 or later of the Jenkins AppSpider Plugin.
You can find more information about this vulnerability in the GitHub Advisory Database (https://github.com/github/advisory-database/advisories/GHSA-xxv9-w5hm-328j).
Related vulnerabilities
Recent vulnerabilities recorded for com.rapid7:jenkinsci-appspider-plugin.
