PT-2024-1424 · Jenkins+1 · Jenkins Gitlab Branch Source Plugin+2

Francois Marot · Published 2024-01-24 · Updated 2024-04-11 · CVE-2024-23901

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins GitLab Branch Source Plugin versions 684.vea fa 7c1e2fe3 and earlier

Description The issue is related to insufficient access control in the Jenkins GitLab Branch Source Plugin. This allows attackers to configure and share a project, resulting in a crafted Pipeline being built by Jenkins during the next scan of the group. The plugin unconditionally discovers projects that are shared with the configured owner group, enabling remote attackers to exploit this weakness.

Recommendations For Jenkins GitLab Branch Source Plugin versions 684.vea fa 7c1e2fe3 and earlier, consider updating to a version that includes the new trait "Discover shared projects" to mitigate the risk of exploitation, such as GitLab Branch Source Plugin 688.v5fa 356ee8520. As a temporary workaround, restrict the plugin's ability to discover projects shared with the configured owner group until a patch is applied.

Fix

Improper Access Control

Information Disclosure

Weakness Enumeration

CWE-284

CWE-200

Related Identifiers

BDU:2024-00897

CVE-2024-23901

GHSA-FW9H-CXX9-GFQ3

Affected Products

Jenkins

Jenkins Gitlab Branch Source Plugin

Red Os

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2024-23901 · Security Note
• https://jenkins.io/security/advisory/2024-01-24/#SECURITY-3040 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fw9h-cxx9-gfq3 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-00897 · Security Note
• https://osv.dev/vulnerability/CVE-2024-23901 · Vendor Advisory
• https://github.com/jenkinsci/gitlab-branch-source-plugin · Note
• https://github.com/jenkinsci/gitlab-branch-source-plugin/commit/969ccece8e2185ecdb7c342b27173af1ab17045c · Note
• https://vuldb.com/ru/?id.252001 · Note
• https://twitter.com/CVEnew/status/1750221652527382632 · Twitter Post
• http://openwall.com/lists/oss-security/2024/01/24/6 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-jenkins-11-04-24 · Note