Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS0zeGY5LXBnYzItbXI5Y84AAzW5

Jenkins SAML Single Sign On(SSO) Plugin missing permission checks

Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier does not perform permission checks in multiple HTTP endpoints.

This allows attackers with Overall/Read permission to send an HTTP request to an attacker-specified URL and parse the response as XML, or parse a local file on the Jenkins controller as XML.

As the plugin does not configure its XML parser to prevent XML external entity (XXE) attacks, attackers can have Jenkins parse a crafted XML response that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

SAML Single Sign On(SSO) Plugin 2.1.0 requires POST requests and Overall/Administer permission for the affected HTTP endpoints.

Permalink: https://github.com/advisories/GHSA-3xf9-pgc2-mr9c
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zeGY5LXBnYzItbXI5Y84AAzW5
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 12 months ago
Updated: 6 months ago

CVSS Score: 7.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Identifiers: GHSA-3xf9-pgc2-mr9c, CVE-2023-32992
References:

• https://nvd.nist.gov/vuln/detail/CVE-2023-32992
• https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-2993
• https://github.com/advisories/GHSA-3xf9-pgc2-mr9c

Blast Radius: 1.0

Affected Packages