CVE-2023-49652 Jenkins Google Compute Engine Plugin has incorrect permission checks
Attackers with global configure permissions can enumerate system credentials and access Google Cloud projects due to missing authorization checks in the Jenkins GCE plugin.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-49652?
CVE-2023-49652 is a low-severity missing authorization vulnerability in Jenkins Google Compute Engine Plugin, published on 29 Nov 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Incorrect permission checks in Jenkins Google Compute Engine Plugin 4.550.vb_327fca_3db_11 and earlier allow attackers with global Item/Configure permission (while lacking Item/Configure permission on any particular job) to enumerate system-scoped credentials IDs of credentials stored in Jenkins and to connect to Google Cloud Platform using attacker-specified credentials IDs obtained through another method, to obtain information about existing projects. This fix has been backported to 4.3.17.1.
Weakness: CWE-862
Which versions are affected by CVE-2023-49652?
4 open source packages ship an affected version, including org.jenkins-ci.plugins:google-compute-engine. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.plugins:google-compute-engine Maven | All versions | 4.3.17.1 |
org.jenkins-ci.plugins:google-compute-engine Maven | All versions | 4.3.17.1 |
org.jenkins-ci.plugins:google-compute-engine Maven | From 4.5 | 4.551.v5a |
org.jenkins-ci.plugins:google-compute-engine Maven | From 4.5 | 4.551.v5a |
Products include Jenkins Google Compute Engine.
How do I fix CVE-2023-49652?
Upgrade org.jenkins-ci.plugins:google-compute-engine to a fixed version for your release line: 4.3.17.1 or 4.551.v5a.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-49652 being exploited?
There is no known exploitation of CVE-2023-49652 in the wild and no public exploit code.
Other vulnerabilities in Jenkins Google Compute Engine Plugin
- CVE-2023-49673 Jenkins NeuVector Vulnerability Scanner Plugin Cross-Site Request Forgery vulnerability
- CVE-2019-16548 Jenkins Google Compute Engine Plugin Cross-Site Request Forgery vulnerability
- CVE-2019-16546 Jenkins Google Compute Engine Plugin does not verify SSH host keys when connecting agents created by the plugin
- CVE-2022-29052 Private key stored in plain text by Jenkins Google Compute Engine Plugin
- CVE-2019-16547 Jenkins Google Compute Engine Plugin Missing Authorization vulnerability
Sources
Also known as GHSA-pgpj-83g3-mfr2.