ESB-2017.3119 - [Win][UNIX/Linux] Jenkins: Cross-site scripting - Existing account 2017-12-06

Printable version
PGP/GPG verifiable version

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2017.3119
                   Jenkins Security Advisory 2017-12-05
                              6 December 2017

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           Jenkins
Publisher:         Jenkins
Operating System:  UNIX variants (UNIX, Linux, OSX)
                   Windows
Impact/Access:     Cross-site Scripting -- Existing Account
Resolution:        Mitigation

Original Bulletin: 
   https://jenkins.io/security/advisory/2017-12-05/

- --------------------------BEGIN INCLUDED TEXT--------------------

Jenkins Security Advisory 2017-12-05

This advisory announces a vulnerability in Jenkins (weekly and LTS) and 
various plugins.

Description

Stored XSS vulnerability in tool names exploitable by administrators

SECURITY-624

Jenkins administrators can configure tools, such as JDK, Maven, or Ant, that 
will be available in job configurations for use by build scripts.

Some tool names are not properly escaped on job configuration forms, resulting
in a stored cross-site scripting vulnerability.

Tools confirmed to be affected are:

JDK (provided by Jenkins core)

Ant (provided by Ant plugin)

Others may also be affected by this.

This vulnerability can only be exploited by Jenkins administrators, as theyre
the only ones able to define tools. In regular Jenkins configurations, 
administrators are able to run any code and install any plugin. Therefore this
vulnerability only really affects installations that dont grant administrators
the Run Scripts, Configure Update Sites, and/or Install Plugins permissions.

As of publication of this advisory, there is no fix.

The Jenkins project has prepared a plugin preventing the configuration of 
unsafe tool names at https://github.com/jenkinsci-cert/security624. If youre 
affected by this issue (i.e. are operating an instance restricting the 
permissions of administrators) we recommend installing the above plugin. You 
will need to build this plugin yourself. We are not planning to distribute it
on our update sites, as we are unaware of any open source plugins enabling a 
configuration that would be affected by this vulnerability.

Severity

SECURITY-624: medium

Affected versions

All versions of Jenkins

Fix

As of publication of this advisory, there is no fix available other than the 
workaround provided above.

Credit

The Jenkins project would like to thank the reporters for discovering and 
reporting these vulnerabilities:

Dhiraj Datar, Lakhshya Cyber Security Labs for SECURITY-624

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBWidSb4x+lLeg9Ub1AQgkyA/9EeSMQhdtXsTdUo4PKFFuUrR/DHL8znYn
iEZOrh37qe/bcfqEx0qCyv6mKal5UyyL214al7OmzQa3zTQs75DrMSKAliw5fTu5
VL1gvyJO4w6bqeFsMfhpQlHhhPkdiO4rZezMYaeNbzThqpIpLeH5BLhyzGqw2UU+
i7V60Ga/upO3//naPOhNcDi9/gOi4eA2lEgA/rBeLkcK32bTyNkUJ1b2GlC6UAYa
GxEHHZZTWFnPIFH7LII1WI+pkv4lDHo3CFEPfKIIauXH9N3QVgWgmOzXJuEyz03U
a+FJv+JfR+1IpexcHdLUSk/URBIOZqKSFL7n6MOpU+EEnbZvjpsg+k4yqvykUY5O
0WG4YetPxk5r8mGhIeSUTHzw7iFggP+1v3km6tPiOQkN87xLS5+6x72Qtv4dt3mb
O7Uzy3jYmEkprVBbmnNN3gsaz3yld3TA21oytE9LUtI+mZuLk+fl7ELqixbq2AXY
YzSRva9DrTNtfE++hDK4C5oLI1M89WizU0LhRlcBGNUlI71kkbEb1BIRO6XDrAlL
dF0kEoc3Rq6wC4mxIgWZrTgXjDwJAizkgzqzcHkCPzgdePkN8fAiHeljxWhYfLyK
UTrv5RuJ98VCPNnhtoHNFHoAePMpb6Jme1wZgAGW4Z1HbPv2zM0fr8GQOrF5QRpp
ZGln3/LxNu8=
=Ypg7
-----END PGP SIGNATURE-----

« Back to bulletins