CVE-2018-1000015 Incorrect permission checks in Pipeline: Nodes and Processes plugin
Attackers can execute pipeline code on agents without proper Computer/Build permissions due to incorrect checks in the Nodes and Processes plugin.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2018-1000015?
CVE-2018-1000015 is a medium-severity missing authorization vulnerability in n/a, published on 23 Jan 2018. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
On Jenkins instances with Authorize Project plugin, the authentication associated with a build may lack the Computer/Build permission on some agents. This did not prevent the execution of Pipeline `node` blocks on those agents due to incorrect permissions checks in Pipeline: Nodes and Processes plugin 2.17 and earlier.
Weakness: CWE-862
Which versions are affected by CVE-2018-1000015?
2 open source packages ship an affected version, including org.jenkins-ci.plugins.workflow:workflow-durable-task-step. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.plugins.workflow:workflow-durable-task-step Maven | All versions | 2.18 |
org.jenkins-ci.plugins.workflow:workflow-durable-task-step Maven | All versions | 2.18 |
Products include Jenkins Pipeline Nodes and Processes.
How do I fix CVE-2018-1000015?
Upgrade org.jenkins-ci.plugins.workflow:workflow-durable-task-step to 2.18 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2018-1000015 being exploited?
There is no known exploitation of CVE-2018-1000015 in the wild and no public exploit code.
Sources
Also known as GHSA-9r7f-rqhw-j8h8.