Jenkins Security Advisory 2019-11-21

Sandbox protection in Script Security Plugin could be circumvented through closure default parameter expressions.

This allowed attackers able to specify and run sandboxed scripts to execute arbitrary code in the context of the Jenkins controller JVM.

These expressions are now subject to sandbox protection.

Support Core Plugin did not validate the paths submitted for the "Delete Support Bundles" feature. This allowed users to delete arbitrary files on the Jenkins controller file system accessible to the OS user account running Jenkins.

Additionally, this endpoint did not perform a permission check, allowing users with Overall/Read permission to delete support bundles, and any arbitrary other file, with a known name/path.

Support Core Plugin now only allows the deletion of support bundles and related files listed on the UI through this feature. It also ensures that only users with "Download Bundle" permission are able to delete support bundles.

Jira Plugin allows the definition of per-folder Jira sites.

The credentials lookup for this feature did not set the appropriate context, allowing the use of System-scoped credentials otherwise reserved for use in the global configuration. This allowed users with Item/Configure permission on the folder to access credentials they’re not entitled to, and potentially capture them.

Jira Plugin now defines the appropriate folder context for credential lookup. As a side effect, existing per-folder Jira sites may lose access to already configured System-scoped credentials, as if no credential was specified in the first place.

Anchore Container Image Scanner Plugin stored an Anchore.io service password unencrypted in job config.xml files as part of its configuration. This credential could be viewed by users with Extended Read permission or access to the Jenkins controller file system.

As the affected functionality has been deprecated, and the affected Anchore.io service has been shut down in late 2018, the affected feature has been removed. The password will be removed from the job configuration once it is saved again.

Spira Importer Plugin stored a credential unencrypted in its global configuration file com.inflectra.spiratest.plugins.SpiraBuilder.xml on the Jenkins controller. This credential could be viewed by users with access to the Jenkins controller file system.

Spira Importer Plugin now stores this credential encrypted once its configuration is saved again.

Google Compute Engine Plugin did not use SSH host key verification when connecting to VMs launched by the plugin. This lack of verification could be abused by a MitM attacker to intercept these connections to attacker-specified build agents without warning.

Google Compute Engine Plugin now verifies SSH host keys before executing any commands on agents.

Google Compute Engine Plugin did not verify permissions on multiple auto-complete API endpoints. This allowed users with Overall/Read permissions to view various metadata about the running cloud environment.

Google Compute Engine Plugin now requires the appropriate Job/Configure permission to view these metadata.

Google Compute Engine Plugin did not require POST requests on an API endpoint. This CSRF vulnerability allowed attackers to provision new agents.

Google Compute Engine Plugin now requires POST requests for this API endpoint.

QMetry for JIRA - Test Management Plugin stored credentials unencrypted in job config.xml files on the Jenkins controller as part of its post-build step configuration. This credential could be viewed by users with Extended Read permission or access to the Jenkins controller file system.

QMetry for JIRA - Test Management Plugin now stores these credentials encrypted once the job configuration is saved again.

QMetry for JIRA - Test Management Plugin stores a credential as part of its post-build step configuration.

While the password is stored encrypted on disk since QMetry for JIRA - Test Management Plugin 1.13, it is transmitted in plain text as part of the configuration form. This can result in exposure of the password through browser extensions, cross-site scripting vulnerabilities, and similar situations.

As of publication of this advisory, there is no fix.