PT-2023-6543 · Cloudbees+1 · Jenkins Cloudbees Cd Plugin+1

Andrea Chiera · Published 2023-10-25 · Updated 2023-11-01 · CVE-2023-46654

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions Jenkins CloudBees CD Plugin versions 1.1.32 and earlier

Description The issue is related to the handling of symbolic links during the cleanup process of the 'CloudBees CD - Publish Artifact' post-build step. This allows attackers who can configure jobs to delete arbitrary files on the Jenkins controller file system. The vulnerability is caused by the plugin following symbolic links to locations outside of the expected directory.

Recommendations For Jenkins CloudBees CD Plugin versions 1.1.32 and earlier, update to version 1.1.33 or later, which deletes symbolic links without following them, thus resolving the issue.

Fix

Link Following

Path traversal

Weakness Enumeration

CWE-59

CWE-61

CWE-22

Related Identifiers

BDU:2023-07305

CVE-2023-46654

GHSA-JX7X-RF3F-J644

Affected Products

Jenkins

Jenkins Cloudbees Cd Plugin

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2023-46654 · Security Note
• https://osv.dev/vulnerability/GHSA-jx7x-rf3f-j644 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07305 · Security Note
• https://osv.dev/vulnerability/CVE-2023-46654 · Vendor Advisory
• https://jenkins.io/security/advisory/2023-10-25/#SECURITY-3237 · Vendor Advisory
• https://github.com/jenkinsci/electricflow-plugin · Note
• https://github.com/jenkinsci/electricflow-plugin/commit/e45ca8428ae45f45ca07611e802eaa0f1484ab50 · Note
• http://openwall.com/lists/oss-security/2023/10/25/2 · Note
• https://vuldb.com/?id.243424 · Note
• https://twitter.com/fletch_ai/status/1719536495290171507 · Twitter Post
• https://tenable.com/cve/CVE-2023-46654 · Note
• https://cybersecurity-help.cz/vdb/SB2023102612 · Note
• https://t.me/latest_high_impact_cve/65 · Telegram Post