Jenkins Security Home

For Administrators For Reporters For Maintainers Jenkins Security Team

Jenkins Security Advisory 2021-06-10

This advisory announces vulnerabilities in the following Jenkins deliverables:

Descriptions

Missing permission checks allow enumerating credentials IDs in Kubernetes CLI Plugin

SECURITY-2370 / CVE-2021-21661

Kubernetes CLI Plugin 1.10.0 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

An enumeration of credentials IDs in Kubernetes CLI Plugin 1.10.1 requires the appropriate permissions.

Missing permission check in XebiaLabs XL Deploy Plugin allows enumerating credentials IDs

SECURITY-1981 / CVE-2021-21662

XebiaLabs XL Deploy Plugin 10.0.1 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

An enumeration of credentials IDs in XebiaLabs XL Deploy Plugin 10.0.2 requires the appropriate permissions.

CSRF vulnerability and missing permission check in XebiaLabs XL Deploy Plugin allows capturing credentials

SECURITY-1982 / CVE-2021-21663 (missing permission check), CVE-2021-21664 (incorrect permission check), CVE-2021-21665 (CSRF)

XebiaLabs XL Deploy Plugin 10.0.1 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing Username/password credentials stored in Jenkins.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

XebiaLabs XL Deploy Plugin 10.0.2 requires POST requests and Overall/Administer permission for the affected form validation method.

Note
 The permission check was partially fixed in XebiaLabs XL Deploy Plugin 7.5.9: A permission check was added, but for the wrong permission, still allowing some non-admin users to access the form validation method.

Reflected XSS vulnerability in Kiuwan Plugin

SECURITY-2367 / CVE-2021-21666

Kiuwan Plugin 1.6.0 and earlier does not escape output that can indirectly be controlled through query parameters in an error message for a form validation endpoint.

This results in a reflected cross-site scripting (XSS) vulnerability.

Note
 Only older releases of Jenkins are affected by this vulnerability. Jenkins 2.275 and newer, LTS 2.263.2 and newer include a protection preventing this from being exploitable.

Kiuwan Plugin 1.6.1 escapes affected parts of the error message in the form validation endpoint.

Severity

Affected Versions

  • Kiuwan Plugin up to and including 1.6.0
  • Kubernetes CLI Plugin up to and including 1.10.0
  • XebiaLabs XL Deploy Plugin up to and including 10.0.1

Fix

  • Kiuwan Plugin should be updated to version 1.6.1
  • Kubernetes CLI Plugin should be updated to version 1.10.1
  • XebiaLabs XL Deploy Plugin should be updated to version 10.0.2

These versions include fixes to the vulnerabilities described above. All prior versions are considered to be affected by these vulnerabilities unless otherwise indicated.

Credit

The Jenkins project would like to thank the reporters for discovering and reporting these vulnerabilities:

  • Arnaud Héritier, CloudBees, Inc. for SECURITY-1981
  • Wadeck Follonier, CloudBees, Inc. for SECURITY-1982