GHSA-449w-c77c-vmf6

Suggest an improvement
Source
https://github.com/advisories/GHSA-449w-c77c-vmf6
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/07/GHSA-449w-c77c-vmf6/GHSA-449w-c77c-vmf6.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-449w-c77c-vmf6
Aliases
Published
2022-07-28T00:00:43Z
Modified
2024-02-16T08:10:52.718783Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Lack of authentication mechanism in Jenkins Git Plugin webhook
Details

Git Plugin provides a webhook endpoint at /git/notifyCommit that can be used to notify Jenkins of changes to an SCM repository. For its most basic functionality, this endpoint receives a repository URL, and Jenkins will schedule polling for all jobs configured with the specified repository. In Git Plugin 4.11.3 and earlier, this endpoint can be accessed with GET requests and without authentication. In addition to this basic functionality, the endpoint also accept a sha1 parameter specifying a commit ID. If this parameter is specified, jobs configured with the specified repo will be triggered immediately, and the build will check out the specified commit. Additionally, the output of the webhook endpoint will provide information about which jobs were triggered or scheduled for polling, including jobs the user has no permission to access. This allows attackers with knowledge of Git repository URLs to trigger builds of jobs using a specified Git repository and to cause them to check out an attacker-specified commit, and to obtain information about the existence of jobs configured with this Git repository. Additionally, this webhook endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability. Git Plugin 4.11.4 requires a token parameter which will act as an authentication for the webhook endpoint. While GET requests remain allowed, attackers would need to be able to provide a webhook token. For more information see the plugin documentation.

References

Affected packages

Maven / org.jenkins-ci.plugins:git

Package

Name
org.jenkins-ci.plugins:git
View open source insights on deps.dev
Purl
pkg:maven/org.jenkins-ci.plugins/git

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.11.4

Affected versions

1.*

1.2.0
1.3.0
1.4.0
1.5.0
1.6.0-beta-1

2.*

2.0-beta-2
2.0-beta-3
2.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
2.2.0
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.2.8
2.2.9
2.2.10
2.2.11
2.2.12
2.3-beta-1
2.3-beta-2
2.3-beta-3
2.3-beta-4
2.3
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0-beta1
2.5.0-beta2
2.5.0-beta3
2.5.0-beta4
2.5.0-beta5
2.5.0
2.5.1
2.5.2
2.5.3
2.6.0
2.6.1
2.6.2-beta-1
2.6.2-beta-2
2.6.2
2.6.4
2.6.5

3.*

3.0.0-beta1
3.0.0-beta2
3.0.0
3.0.1
3.0.2-beta-1
3.0.2-beta-2
3.0.2
3.0.3
3.0.4
3.0.5
3.1.0
3.2.0
3.3.0
3.3.1
3.3.2
3.4.0-alpha-1
3.4.0-alpha-4
3.4.0-beta-1
3.4.0-beta-2
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
3.6.1
3.6.2
3.6.3
3.6.4
3.7.0
3.8.0
3.9.0
3.9.1
3.9.2
3.9.3
3.9.4
3.10.0-beta-1
3.10.0
3.10.0.1
3.10.1
3.11.0
3.12.0
3.12.1
3.12.2

4.*

4.0.0-beta1
4.0.0-beta2
4.0.0-beta3
4.0.0-beta4
4.0.0-beta7
4.0.0-beta8
4.0.0-beta9
4.0.0-beta10
4.0.0-beta11
4.0.0-beta12
4.0.0-rc
4.0.0
4.0.1
4.1.0-beta
4.1.0
4.1.1
4.2.0
4.2.1
4.2.2
4.3.0
4.3.1
4.4.0
4.4.1
4.4.2
4.4.3
4.4.4
4.4.5
4.5.0
4.5.1
4.5.2
4.6.0
4.7.0
4.7.1
4.7.1.1
4.7.2
4.8.0
4.8.1
4.8.2
4.8.3
4.9.0
4.9.1
4.9.2
4.9.3
4.9.4
4.10.0
4.10.1
4.10.2
4.10.3
4.11.0
4.11.1
4.11.2
4.11.3

Database specific 

{
    "last_known_affected_version_range": "<= 4.11.3"
}