[JENKINS:SECURITY-284] Lack of authentication mechanism in `git` webhook
git
provides a webhook endpoint at /git/notifyCommit
that can be used to notify Jenkins of changes to an SCM repository.
For its most basic functionality, this endpoint receives a repository URL, and Jenkins will schedule polling for all jobs configured with the specified repository.
In git
4.11.3 and earlier, this endpoint can be accessed with GET requests and without authentication.
In addition to this basic functionality, the endpoint also accept a sha1
parameter specifying a commit ID.
If this parameter is specified, jobs configured with the specified repo will be triggered immediately, and the build will check out the specified commit.
Additionally, the output of the webhook endpoint will provide information about which jobs were triggered or scheduled for polling, including jobs the user has no permission to access.
This allows attackers with knowledge of Git repository URLs to trigger builds of jobs using a specified Git repository and to cause them to check out an attacker-specified commit, and to obtain information about the existence of jobs configured with this Git repository.
Additionally, this webhook endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
git
4.11.4 requires a token
parameter that authorizes requests to the webhook endpoint.
While GET requests remain allowed, attackers would need to be able to provide a webhook token.
For more information see https://github.com/jenkinsci/git-plugin/#push-notification-from-repository[the plugin documentation].
Package | Affected Version |
---|---|
pkg:maven/org.jenkins-ci.plugins/git | <= 4.11.3 |
pkg:github/jenkinsci/git-plugin | <= 4.11.3 |
Package | Fixed Version |
---|---|
pkg:maven/org.jenkins-ci.plugins/git | = 4.11.4 |
pkg:github/jenkinsci/git-plugin | = 4.11.4 |
- ID
- JENKINS:SECURITY-284
- Severity
- medium
- Published
-
2022-07-27T00:00:00
(2 years ago) - Modified
-
2022-07-27T00:00:00
(2 years ago) - Rights
- Jenkins Security Team
- Other Advisories
Source | # ID | Name | URL |
---|---|---|---|
Plugin repository | git repository | https://github.com/jenkinsci/git-plugin |
Type | Package URL | Namespace | Name / Product | Version | Distribution / Platform | Arch | Patch / Fix |
---|---|---|---|---|---|---|---|
Affected | pkg:maven/org.jenkins-ci.plugins/git | org.jenkins-ci.plugins | git | <= 4.11.3 | |||
Fixed | pkg:maven/org.jenkins-ci.plugins/git | org.jenkins-ci.plugins | git | = 4.11.4 | |||
Affected | pkg:github/jenkinsci/git-plugin | jenkinsci | git-plugin | <= 4.11.3 | |||
Fixed | pkg:github/jenkinsci/git-plugin | jenkinsci | git-plugin | = 4.11.4 |
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | Exploits | PoC | Pubblication Date | Modification Date |
---|---|---|---|---|---|---|---|---|---|---|---|
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | PoC | Pubblication Date | Modification Date |