SynopsisA job scheduling and management system hosted on the remote web server is affected by multiple vulnerabilities.
DescriptionThe version of Jenkins running on the remote web server is prior to 2.219 or is a version of Jenkins LTS prior to 2.204.2. It is, therefore, affected by multiple vulnerabilities:
- An UDP amplification reflection attack can be used in a DDoS attack on a Jenkins master. Within the same network, spoofed UDP packets could also be sent to make two Jenkins masters go into an infinite loop of replies to one another, thus causing a denial of service.
- A non-constant time comparison of inbound TCP agent connection secret is used when an inbound TCP agent connection is initiated. This allows attackers to use statistical methods to obtain the connection secret.
- A non-constant time HMAC comparison is used when checking whether two HMACs are equal. This could potentially allow attackers to use statistical methods to obtain a valid HMAC for an attacker-controlled input value. (CVE-2020-2102)
- User metadata on the /whoAmI page includes the HTTP session ID which allows attackers able to exploit a cross-site scripting vulnerability to obtain the HTTP session ID value. (CVE-2020-2103)
- A lack of appropriate permissions allows anyone with Overall/Read permissions to access the JVM memory usage chart for the Jenkins master.
- The Jenkins REST APIs allows an attacker to perform a clickjacking attack by routing them to a specially crafted web page, and can expose the content of the REST API endpoint. (CVE-2020-2105)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
SolutionUpgrade Jenkins to version 2.219 or later, Jenkins LTS to version 2.204.2 or later.