Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS1jNzM1LWc5ZjItMm12cM4AAkDI
Cross-Site Request Forgery in Jenkins
An extension point in Jenkins allows selectively disabling cross-site request forgery (CSRF) protection for specific URLs.
Implementations of that extension point received a different representation of the URL path than the Stapler web framework uses to dispatch requests in Jenkins 2.227 and earlier, LTS 2.204.5 and earlier. This discrepancy allowed attackers to craft URLs that would bypass the CSRF protection of any target URL.
Jenkins now uses the same representation of the URL path to decide whether CSRF protection is needed for a given URL as the Stapler web framework uses.
In case of problems, administrators can disable this security fix by setting the system property hudson.security.csrf.CrumbFilter.UNPROCESSED_PATHINFO
to true
.
As an additional safeguard, semicolon (;
) characters in the path part of a URL are now banned by default. Administrators can disable this protection by setting the system property jenkins.security.SuspiciousRequestFilter.allowSemicolonsInPath
to true
.
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jNzM1LWc5ZjItMm12cM4AAkDI
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: almost 2 years ago
Updated: about 1 month ago
CVSS Score: 8.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Identifiers: GHSA-c735-g9f2-2mvp, CVE-2020-2160
References:
- https://nvd.nist.gov/vuln/detail/CVE-2020-2160
- https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1774
- http://www.openwall.com/lists/oss-security/2020/03/25/2
- https://github.com/jenkinsci/jenkins/commit/f7cf28355973df1ca6eb19066370bf70b10742f7
- https://github.com/jenkinsci/jenkins/commit/f479652171f4ab854747de64b22bf59adb35fb8f
- https://github.com/advisories/GHSA-c735-g9f2-2mvp
Blast Radius: 1.0
Affected Packages
maven:org.jenkins-ci.main:jenkins-core
Affected Version Ranges: >= 2.205, <= 2.227, <= 2.204.5Fixed in: 2.228, 2.204.6