PT-2023-31281 · Jenkins · Jenkins Matlab Plugin+1

Andrea Chiera · Published 2023-11-29 · Updated 2023-12-05 · CVE-2023-49655

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins MATLAB Plugin versions 2.11.0 and earlier

Description A cross-site request forgery (CSRF) vulnerability allows attackers to have Jenkins parse an XML file from the Jenkins controller file system. The plugin determines whether a user-specified directory on the Jenkins controller is the location of a MATLAB installation by parsing an XML file in that directory. The plugin does not perform permission checks in several HTTP endpoints implementing related form validation, and these endpoints do not require POST requests. Additionally, the plugin does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers to extract secrets from the Jenkins controller or perform server-side request forgery.

Recommendations For Jenkins MATLAB Plugin versions 2.11.0 and earlier, update to version 2.11.1 or later, which configures its XML parser to prevent XML external entity (XXE) attacks and requires POST requests and Item/Configure permission for the affected HTTP endpoints. As a temporary workaround, consider restricting access to the affected HTTP endpoints to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2023-49655

GHSA-9F5G-RGCR-8GRW

Affected Products

Jenkins

Jenkins Matlab Plugin

References · 6

• https://osv.dev/vulnerability/GHSA-9f5g-rgcr-8grw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-49655 · Vendor Advisory
• https://jenkins.io/security/advisory/2023-11-29/#SECURITY-3193 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-49655 · Security Note
• http://openwall.com/lists/oss-security/2023/11/29/1 · Note
• https://t.me/cvenotify/62298 · Telegram Post