Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2017.3119
Jenkins Security Advisory 2017-12-05
6 December 2017
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Jenkins
Publisher: Jenkins
Operating System: UNIX variants (UNIX, Linux, OSX)
Windows
Impact/Access: Cross-site Scripting -- Existing Account
Resolution: Mitigation
Original Bulletin:
https://jenkins.io/security/advisory/2017-12-05/
- --------------------------BEGIN INCLUDED TEXT--------------------
Jenkins Security Advisory 2017-12-05
This advisory announces a vulnerability in Jenkins (weekly and LTS) and
various plugins.
Description
Stored XSS vulnerability in tool names exploitable by administrators
SECURITY-624
Jenkins administrators can configure tools, such as JDK, Maven, or Ant, that
will be available in job configurations for use by build scripts.
Some tool names are not properly escaped on job configuration forms, resulting
in a stored cross-site scripting vulnerability.
Tools confirmed to be affected are:
JDK (provided by Jenkins core)
Ant (provided by Ant plugin)
Others may also be affected by this.
This vulnerability can only be exploited by Jenkins administrators, as theyre
the only ones able to define tools. In regular Jenkins configurations,
administrators are able to run any code and install any plugin. Therefore this
vulnerability only really affects installations that dont grant administrators
the Run Scripts, Configure Update Sites, and/or Install Plugins permissions.
As of publication of this advisory, there is no fix.
The Jenkins project has prepared a plugin preventing the configuration of
unsafe tool names at https://github.com/jenkinsci-cert/security624. If youre
affected by this issue (i.e. are operating an instance restricting the
permissions of administrators) we recommend installing the above plugin. You
will need to build this plugin yourself. We are not planning to distribute it
on our update sites, as we are unaware of any open source plugins enabling a
configuration that would be affected by this vulnerability.
Severity
SECURITY-624: medium
Affected versions
All versions of Jenkins
Fix
As of publication of this advisory, there is no fix available other than the
workaround provided above.
Credit
The Jenkins project would like to thank the reporters for discovering and
reporting these vulnerabilities:
Dhiraj Datar, Lakhshya Cyber Security Labs for SECURITY-624
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBWidSb4x+lLeg9Ub1AQgkyA/9EeSMQhdtXsTdUo4PKFFuUrR/DHL8znYn
iEZOrh37qe/bcfqEx0qCyv6mKal5UyyL214al7OmzQa3zTQs75DrMSKAliw5fTu5
VL1gvyJO4w6bqeFsMfhpQlHhhPkdiO4rZezMYaeNbzThqpIpLeH5BLhyzGqw2UU+
i7V60Ga/upO3//naPOhNcDi9/gOi4eA2lEgA/rBeLkcK32bTyNkUJ1b2GlC6UAYa
GxEHHZZTWFnPIFH7LII1WI+pkv4lDHo3CFEPfKIIauXH9N3QVgWgmOzXJuEyz03U
a+FJv+JfR+1IpexcHdLUSk/URBIOZqKSFL7n6MOpU+EEnbZvjpsg+k4yqvykUY5O
0WG4YetPxk5r8mGhIeSUTHzw7iFggP+1v3km6tPiOQkN87xLS5+6x72Qtv4dt3mb
O7Uzy3jYmEkprVBbmnNN3gsaz3yld3TA21oytE9LUtI+mZuLk+fl7ELqixbq2AXY
YzSRva9DrTNtfE++hDK4C5oLI1M89WizU0LhRlcBGNUlI71kkbEb1BIRO6XDrAlL
dF0kEoc3Rq6wC4mxIgWZrTgXjDwJAizkgzqzcHkCPzgdePkN8fAiHeljxWhYfLyK
UTrv5RuJ98VCPNnhtoHNFHoAePMpb6Jme1wZgAGW4Z1HbPv2zM0fr8GQOrF5QRpp
ZGln3/LxNu8=
=Ypg7
-----END PGP SIGNATURE-----