-----BEGIN PGP SIGNED MESSAGE-----
AUSCERT External Security Bulletin Redistribution
Jenkins Security Advisory 2017-12-05
6 December 2017
AusCERT Security Bulletin Summary
Operating System: UNIX variants (UNIX, Linux, OSX)
Impact/Access: Cross-site Scripting -- Existing Account
- --------------------------BEGIN INCLUDED TEXT--------------------
Jenkins Security Advisory 2017-12-05
This advisory announces a vulnerability in Jenkins (weekly and LTS) and
Stored XSS vulnerability in tool names exploitable by administrators
Jenkins administrators can configure tools, such as JDK, Maven, or Ant, that
will be available in job configurations for use by build scripts.
Some tool names are not properly escaped on job configuration forms, resulting
in a stored cross-site scripting vulnerability.
Tools confirmed to be affected are:
JDK (provided by Jenkins core)
Ant (provided by Ant plugin)
Others may also be affected by this.
This vulnerability can only be exploited by Jenkins administrators, as theyre
the only ones able to define tools. In regular Jenkins configurations,
administrators are able to run any code and install any plugin. Therefore this
vulnerability only really affects installations that dont grant administrators
the Run Scripts, Configure Update Sites, and/or Install Plugins permissions.
As of publication of this advisory, there is no fix.
The Jenkins project has prepared a plugin preventing the configuration of
unsafe tool names at https://github.com/jenkinsci-cert/security624. If youre
affected by this issue (i.e. are operating an instance restricting the
permissions of administrators) we recommend installing the above plugin. You
will need to build this plugin yourself. We are not planning to distribute it
on our update sites, as we are unaware of any open source plugins enabling a
configuration that would be affected by this vulnerability.
All versions of Jenkins
As of publication of this advisory, there is no fix available other than the
workaround provided above.
The Jenkins project would like to thank the reporters for discovering and
reporting these vulnerabilities:
Dhiraj Datar, Lakhshya Cyber Security Labs for SECURITY-624
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to firstname.lastname@example.org
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
Australian Computer Emergency Response Team
The University of Queensland
Internet Email: email@example.com
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
-----BEGIN PGP SIGNATURE-----
-----END PGP SIGNATURE-----