Publisher Over CIFS Plugin up to 0.10 on Jenkins CIFS Server CifsPublisherPluginDescriptor.java confused deputy

Summaryinfo

A vulnerability classified as critical has been found in Publisher Over CIFS Plugin up to 0.10 on Jenkins. The affected element is an unknown function of the file CifsPublisherPluginDescriptor.java of the component CIFS Server. The manipulation leads to confused deputy. This vulnerability is listed as CVE-2018-1999038. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability was found in Publisher Over CIFS Plugin up to 0.10 on Jenkins (Jenkins Plugin) and classified as critical. This issue affects some unknown processing of the file CifsPublisherPluginDescriptor.java of the component CIFS Server. The manipulation with an unknown input leads to a confused deputy vulnerability. Using CWE to declare the problem leads to CWE-441. The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A confused deputy vulnerability exists in Jenkins Publisher Over CIFS Plugin 0.10 and earlier in CifsPublisherPluginDescriptor.java that allows attackers to have Jenkins connect to an attacker specified CIFS server with attacker specified credentials.

The bug was discovered 07/30/2018. The weakness was presented 08/01/2018 (Website). The advisory is shared at jenkins.io. The identification of this vulnerability is CVE-2018-1999038 since 08/01/2018. The attack may be initiated remotely. Required for exploitation is a simple authentication. Technical details are known, but no exploit is available.

The vulnerability was handled as a non-public zero-day exploit for at least 2 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Jenkins Plugin

Name

• Publisher Over CIFS Plugin

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion