PT-2017-10796 · Github+1 · Github Branch Source Plugin+1

Jesse Glick · Published 2017-10-04 · Updated 2022-05-17 · CVE-2017-1000091

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GitHub Branch Source Plugin (affected versions not specified)

Description The GitHub Branch Source Plugin has a functionality that connects to a user-specified GitHub API URL as part of form validation and completion. This functionality improperly checked permissions, allowing any user with Overall/Read access to Jenkins to connect to any web server and send credentials with a known ID, potentially capturing them. The issue also allowed these actions to be performed without direct access to Jenkins via Cross-Site Request Forgery, as it did not require POST requests.

Recommendations For the GitHub Branch Source Plugin, to mitigate the issue, consider requiring Extended Read permission (or Configure permission if Extended Read is not enabled) to access credentials in the context of a job. If no job context exists, require Overall/Administer permission. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2017-1000091

GHSA-W66R-F5GG-GQWM

Affected Products

Github Branch Source Plugin

Jenkins

References · 5

• https://jenkins.io/security/advisory/2017-07-10 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000091 · Security Note
• https://osv.dev/vulnerability/GHSA-w66r-f5gg-gqwm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-1000091 · Vendor Advisory
• https://github.com/jenkinsci/github-branch-source-plugin · Note