Fix CVE-2022-27204 / SECURITY-1350 #39

ciis0 · 2022-05-25T08:40:02Z

https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-1350

Implement suggestion from https://www.jenkins.io/doc/developer/security/form-validation/

Make sure you are opening from a topic/feature/bugfix branch (right side) and not your main branch!
Ensure that the pull request title represents the desired changelog entry
Please describe what you did
Link to relevant issues in GitHub or Jira: SECURITY-1350
Link to relevant pull requests, esp. upstream and downstream changes
Ensure you have provided tests - that demonstrates feature works or fixes the issue

Fix CVE from title by applying suggestions from https://www.jenkins.io/doc/developer/security/form-validation/.

Implement suggestion from https://www.jenkins.io/doc/developer/security/form-validation/

ciis0 · 2022-05-25T09:14:05Z

Locally, GET does not work anymore:

C:\Users\A613952>curl.exe -v -u admin:<snip> "http://localhost:8080/job/test/descriptorByName/com.cwctravel.hudson.plugins.extended_choice_parameter.ExtendedChoiceParameterDefinition/checkPropertyFile?propertyFile=https%3A%2F%2Fssrf.example.com"
*   Trying 127.0.0.1:8080...
* Connected to localhost (127.0.0.1) port 8080 (#0)
* Server auth using Basic with user 'admin'
> GET /job/test/descriptorByName/com.cwctravel.hudson.plugins.extended_choice_parameter.ExtendedChoiceParameterDefinition/checkPropertyFile?propertyFile=https%3A%2F%2Fssrf.example.com HTTP/1.1
> Host: localhost:8080
> Authorization: Basic <snip>
> User-Agent: curl/7.79.1
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 404 Not Found
< X-Content-Type-Options: nosniff
< Cache-Control: must-revalidate,no-cache,no-store
< Content-Type: text/html;charset=iso-8859-1
< Content-Length: 576
< Server: Jetty(9.4.43.v20210629)
<
<html>
<head>
<meta http-equiv="Content-Type" content="text/html;charset=utf-8"/>
<title>Error 404 Not Found</title>
</head>
<body><h2>HTTP ERROR 404 Not Found</h2>
<table>
<tr><th>URI:</th><td>/job/test/descriptorByName/com.cwctravel.hudson.plugins.extended_choice_parameter.ExtendedChoiceParameterDefinition/checkPropertyFile</td></tr>
<tr><th>STATUS:</th><td>404</td></tr>
<tr><th>MESSAGE:</th><td>Not Found</td></tr>
<tr><th>SERVLET:</th><td>Stapler</td></tr>
</table>
<hr><a href="https://eclipse.org/jetty">Powered by Jetty:// 9.4.43.v20210629</a><hr/>

</body>
</html>
* Connection #0 to host localhost left intact

And POST is CSRF protected:

C:\Users\A613952>curl.exe -X POST -v -u admin:<snip> "http://localhost:8080/job/test/descriptorByName/com.cwctravel.hudson.plugins.extended_choice_parameter.ExtendedChoiceParameterDefinition/checkPropertyFile?propertyFile=https%3A%2F%2Fssrf.example.com"
*   Trying 127.0.0.1:8080...
* Connected to localhost (127.0.0.1) port 8080 (#0)
* Server auth using Basic with user 'admin'
> POST /job/test/descriptorByName/com.cwctravel.hudson.plugins.extended_choice_parameter.ExtendedChoiceParameterDefinition/checkPropertyFile?propertyFile=https%3A%2F%2Fssrf.example.com HTTP/1.1
> Host: localhost:8080
> Authorization: Basic <snip>
> User-Agent: curl/7.79.1
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 403 Forbidden
< X-Content-Type-Options: nosniff
< Cache-Control: must-revalidate,no-cache,no-store
< Content-Type: text/html;charset=iso-8859-1
< Content-Length: 675
< Server: Jetty(9.4.43.v20210629)
<
<html>
<head>
<meta http-equiv="Content-Type" content="text/html;charset=utf-8"/>
<title>Error 403 No valid crumb was included in the request</title>
</head>
<body><h2>HTTP ERROR 403 No valid crumb was included in the request</h2>
<table>
<tr><th>URI:</th><td>/job/test/descriptorByName/com.cwctravel.hudson.plugins.extended_choice_parameter.ExtendedChoiceParameterDefinition/checkPropertyFile</td></tr>
<tr><th>STATUS:</th><td>403</td></tr>
<tr><th>MESSAGE:</th><td>No valid crumb was included in the request</td></tr>
<tr><th>SERVLET:</th><td>Stapler</td></tr>
</table>
<hr><a href="https://eclipse.org/jetty">Powered by Jetty:// 9.4.43.v20210629</a><hr/>

</body>
</html>
* Connection #0 to host localhost left intact

foxdalas · 2022-06-15T05:53:16Z

@vimil Hi! What do you think about this pr?

LukaSvastVolue · 2022-07-05T06:58:04Z

@vimil any progress here, it would be great if this fix is merged

ciis0 · 2022-07-05T08:51:44Z

Pinging more members who could have write access
@Vlatombe @oleg-nenashev @cjo9900 @olivergondza @mat1e

charlysotelo · 2022-07-08T14:58:50Z

Pretty please? What can we do to move this along?

paul-uz · 2022-08-18T09:52:26Z

+1

ciis0 · 2022-09-09T07:05:44Z

Note: You can download my fixed version from CI:

https://ci.jenkins.io/blue/organizations/jenkins/Plugins%2Fextended-choice-parameter-plugin/detail/PR-39/1/artifacts

https://ci.jenkins.io/job/Plugins/job/extended-choice-parameter-plugin/job/PR-39/1/artifact/org/jenkins-ci/plugins/extended-choice-parameter/347.va_2f0c3b_f1849/extended-choice-parameter-347.va_2f0c3b_f1849.hpi

seam33 · 2022-09-21T14:51:44Z

@ciis0 Hi, I am using your fixed version and the warning keeps to pop up. So, I would like to know when you can merge the new version? Does we need waiting more time? It is important because, I am using it in some workflows....

criztovyl · 2022-09-22T08:12:05Z

Hi @seam33,

ciis0 does not have the permission to merge the PR, that needs to be done by an official Jenkins maintainer, but we could not get the attention of one yet.

As such we'll need more patience.

daniel-beck · 2022-09-28T11:59:25Z

This fix looks incomplete, it only addresses the CSRF issue, not the missing permission checks.

Regarding getting a new release with security issues being fixed when maintainers are unresponsive, see https://www.jenkins.io/doc/developer/plugin-governance/adopt-a-plugin/

criztovyl · 2022-09-28T14:13:22Z

For CVE-2022-27204 the fix is complete (perm check is 05), only for SECURITY-1350 it is incomplete.

I consider the CSRF more severe and easy to fix, while the perm check is not as severe and not as easy to fix.

I will have a look at adopting the plugin.

daniel-beck · 2022-09-28T16:44:38Z

For GHSA-fqpx-xfjr-2qr9 the fix is complete (perm check is 05)

Good point. We'd still leave the security warning up even if this is addressed, because there's only one advisory entry and warning for both CVEs.

… more severe … not as severe …

Depends on your setup, if you were an admin of ci.jenkins.io you'd see this differently :)

CVE-2022-27204

a2f0c3b

Implement suggestion from https://www.jenkins.io/doc/developer/security/form-validation/

ciis0 marked this pull request as ready for review May 25, 2022 09:04

ciis0 changed the title ~~Fix CVE-2022-27204 /~~ Fix CVE-2022-27204 / SECURITY-1350 May 25, 2022

chonton merged commit eff9472 into jenkinsci:master Nov 6, 2022

chonton mentioned this pull request Dec 4, 2022

remediate SECURITY-1350 and SECURITY-1351 jenkins-infra/update-center2#659

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix CVE-2022-27204 / SECURITY-1350 #39

Fix CVE-2022-27204 / SECURITY-1350 #39

ciis0 commented May 25, 2022 •

edited

Loading

ciis0 commented May 25, 2022

foxdalas commented Jun 15, 2022

LukaSvastVolue commented Jul 5, 2022

ciis0 commented Jul 5, 2022

charlysotelo commented Jul 8, 2022

paul-uz commented Aug 18, 2022

ciis0 commented Sep 9, 2022

seam33 commented Sep 21, 2022

criztovyl commented Sep 22, 2022

daniel-beck commented Sep 28, 2022

criztovyl commented Sep 28, 2022

daniel-beck commented Sep 28, 2022

Fix CVE-2022-27204 / SECURITY-1350 #39

Fix CVE-2022-27204 / SECURITY-1350 #39

Conversation

ciis0 commented May 25, 2022 • edited Loading

ciis0 commented May 25, 2022

foxdalas commented Jun 15, 2022

LukaSvastVolue commented Jul 5, 2022

ciis0 commented Jul 5, 2022

charlysotelo commented Jul 8, 2022

paul-uz commented Aug 18, 2022

ciis0 commented Sep 9, 2022

seam33 commented Sep 21, 2022

criztovyl commented Sep 22, 2022

daniel-beck commented Sep 28, 2022

criztovyl commented Sep 28, 2022

daniel-beck commented Sep 28, 2022

ciis0 commented May 25, 2022 •

edited

Loading