DRY Plugin up to 2.49 on Jenkins XML Data xml external entity reference

Summaryinfo

A vulnerability has been found in DRY Plugin up to 2.49 on Jenkins and classified as critical. Affected is an unknown function of the component XML Data Handler. Performing a manipulation results in xml external entity reference. This vulnerability was named CVE-2018-1000010. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability was found in DRY Plugin up to 2.49 on Jenkins (Jenkins Plugin). It has been classified as critical. This affects an unknown part of the component XML Data Handler. The manipulation with an unknown input leads to a xml external entity reference vulnerability. CWE is classifying the issue as CWE-611. The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Jenkins DRY Plugin 2.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.

The bug was discovered 01/22/2018. The weakness was presented 01/23/2018 (Website). The advisory is shared at jenkins.io. This vulnerability is uniquely identified as CVE-2018-1000010 since 01/23/2018. The exploitability is told to be easy. It is possible to initiate the attack remotely. A authentication is necessary for exploitation. Neither technical details nor an exploit are publicly available.

The vulnerability was handled as a non-public zero-day exploit for at least 1 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

See VDB-112351, VDB-112352, VDB-112354 and VDB-112355 for similar entries. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Jenkins Plugin

Name

• DRY Plugin

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11
• 2.12
• 2.13
• 2.14
• 2.15
• 2.16
• 2.17
• 2.18
• 2.19
• 2.20
• 2.21
• 2.22
• 2.23
• 2.24
• 2.25
• 2.26
• 2.27
• 2.28
• 2.29
• 2.30
• 2.31
• 2.32
• 2.33
• 2.34
• 2.35
• 2.36
• 2.37
• 2.38
• 2.39
• 2.40
• 2.41
• 2.42
• 2.43
• 2.44
• 2.45
• 2.46
• 2.47
• 2.48
• 2.49

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion