PT-2020-2656 · Cloudbees+1 · Jenkins

Nick Collisson · Published 2020-03-25 · Updated 2024-03-06 · CVE-2020-2160

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.227 and earlier Jenkins LTS versions 2.204.5 and earlier

Description The issue is related to the absence of protection against cross-site request forgery (CSRF) in Jenkins. This allows attackers to craft URLs that bypass CSRF protection for any target URL, potentially enabling them to perform arbitrary actions on a vulnerable device using a specially crafted web page. The discrepancy in URL path representation between the extension point and the Stapler web framework in Jenkins versions 2.227 and earlier, LTS 2.204.5 and earlier, is the root cause of this problem.

Recommendations For Jenkins versions 2.227 and earlier, update to a version that uses the same representation of the URL path to decide whether CSRF protection is needed for a given URL as the Stapler web framework uses. For Jenkins LTS versions 2.204.5 and earlier, update to a version that uses the same representation of the URL path to decide whether CSRF protection is needed for a given URL as the Stapler web framework uses. As a temporary workaround, consider setting the system property hudson.security.csrf.CrumbFilter.UNPROCESSED PATHINFO to true to disable this security fix in case of problems. Additionally, consider setting the system property jenkins.security.SuspiciousRequestFilter.allowSemicolonsInPath to true to disable the protection against semicolon (;) characters in the path part of a URL, if necessary.

Fix

CSRF

Weakness Enumeration

CWE-435

CWE-352

Related Identifiers

BDU:2020-02700

BIT-JENKINS-2020-2160

CVE-2020-2160

GHSA-C735-G9F2-2MVP

Affected Products

Jenkins

References · 13

• https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1774 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2160 · Security Note
• https://osv.dev/vulnerability/BIT-jenkins-2020-2160 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-2160 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c735-g9f2-2mvp · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-02700 · Security Note
• https://github.com/jenkinsci/jenkins · Note
• https://github.com/jenkinsci/jenkins/commit/f479652171f4ab854747de64b22bf59adb35fb8f · Note
• https://github.com/jenkinsci/jenkins/commit/f7cf28355973df1ca6eb19066370bf70b10742f7 · Note
• https://t.me/cvenotify/2135 · Telegram Post
• http://openwall.com/lists/oss-security/2020/03/25/2 · Note
• https://cybersecurity-help.cz/vdb/SB2020032622 · Note
• https://openwall.com/lists/oss-security/2020/03/25/2 · Note