Jenkins LTS < 2.289.2 / Jenkins weekly < 2.300 Multiple Vulnerabilities

medium Nessus Plugin ID 151193
New! Plugin Severity Now Using CVSS v3

The calculated severity for Plugins has been updated to use CVSS v3 by default. Plugins that do not have a CVSS v3 score will fall back to CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Synopsis

An application running on a remote web server host is affected by multiple vulnerabilities

Description

According to its its self-reported version number, the version of Jenkins running on the remote web server is Jenkins LTS prior to 2.289.2 or Jenkins weekly prior to 2.300. It is, therefore, affected by multiple vulnerabilities:

- Jenkins 2.299 and earlier, LTS 2.289.1 and earlier allows users to cancel queue items and abort builds of jobs for which they have Item/Cancel permission even when they do not have Item/Read permission. Jenkins 2.300, LTS 2.289.2 requires that users have Item/Read permission for applicable types in addition to Item/Cancel permission. As a workaround on earlier versions of Jenkins, do not grant Item/Cancel permission to users who do not have Item/Read permission. (CVE-2021-21670)

- Jenkins 2.299 and earlier, LTS 2.289.1 and earlier does not invalidate the existing session on login. This allows attackers to use social engineering techniques to gain administrator access to Jenkins. This vulnerability was introduced in Jenkins 2.266 and LTS 2.277.1. Jenkins 2.300, LTS 2.289.2 invalidates the existing session on login. Note In case of problems, administrators can choose a different implementation by setting the Java system property hudson.security.SecurityRealm.sessionFixationProtectionMode to 2, or disable the fix entirely by setting that system property to 0. (CVE-2021-21671)

- Selenium HTML report Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. This allows attackers with the ability to control the report files parsed using this plugin to have Jenkins parse a crafted report file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery. Selenium HTML report Plugin 1.1 disables external entity resolution for its XML parser. (CVE-2021-21672)

- CAS Plugin 1.6.0 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins. This allows attackers to perform phishing attacks by having users go to a Jenkins URL that will forward them to a different site after successful authentication. CAS Plugin 1.6.1 only redirects to relative (Jenkins) URLs. (CVE-2021-21673)

- requests-plugin Plugin 2.2.6 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to view the list of pending requests. requests-plugin Plugin 2.2.7 requires Overall/Read permission to view the list of pending requests. (CVE-2021-21674)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Upgrade Jenkins weekly to version 2.300 or later or Jenkins LTS to version 2.289.2 or later

See Also

https://jenkins.io/security/advisory/2021-06-30

Plugin Details

Severity: Medium

ID: 151193

File Name: jenkins_2_300.nasl

Version: 1.6

Type: combined

Agent: windows, macosx, unix

Family: CGI abuses

Published: 6/30/2021

Updated: 10/14/2021

Dependencies: jenkins_detect.nasl, jenkins_win_installed.nbin, jenkins_nix_installed.nbin, macosx_jenkins_installed.nbin

Risk Information

CVSS Score Source: CVE-2021-21673

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: Medium

Base Score: 5.8

Temporal Score: 4.3

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N

Temporal Vector: E:U/RL:OF/RC:C

CVSS v3

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 5.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:cloudbees:jenkins, cpe:/a:jenkins:jenkins

Required KB Items: installed_sw/Jenkins

Exploit Ease: No known exploits are available

Patch Publication Date: 6/30/2021

Vulnerability Publication Date: 6/30/2021

Reference Information

CVE: CVE-2021-21670, CVE-2021-21671, CVE-2021-21672, CVE-2021-21673, CVE-2021-21674

IAVA: 2021-A-0335-S