PT-2020-15377 · Jenkins · Jenkins Cryptomove Plugin+1

Wasin Saengow · Published 2020-03-09 · Updated 2023-10-25 · CVE-2020-2159

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Jenkins CryptoMove Plugin versions 0.1.33 and earlier

Description The issue allows attackers with Job/Configure access to execute arbitrary OS commands on the Jenkins master as the OS user account running Jenkins. This is possible because the CryptoMove Plugin allows the configuration of an OS command to execute as part of its build step configuration, which will be executed on the Jenkins controller. Users with Job/Configure permission can exploit this to execute arbitrary OS commands on the Jenkins controller.

Recommendations For Jenkins CryptoMove Plugin versions 0.1.33 and earlier, consider restricting access to the Job/Configure permission to minimize the risk of exploitation. As a temporary workaround, consider disabling the build step configuration that allows the execution of OS commands until a patch is available.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2020-2159

GHSA-P5X5-JG3J-2JCJ

Affected Products

Jenkins

Jenkins Cryptomove Plugin

References · 6

• https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1635 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2159 · Security Note
• https://osv.dev/vulnerability/CVE-2020-2159 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p5x5-jg3j-2jcj · Vendor Advisory
• https://github.com/jenkinsci/cryptomove-plugin · Note
• http://openwall.com/lists/oss-security/2020/03/09/1 · Note