Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows reading arbitrary files using the file browser for workspaces and archived artifacts by following symlinks.
Weakness
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Jenkins | Jenkins | * | 2.263.1 (including) |
| Jenkins | Jenkins | * | 2.274 (including) |
| Red Hat OpenShift Container Platform 3.11 | RedHat | jenkins-0:2.263.3.1612433584-1.el7 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | conmon-2:2.0.21-1.rhaos4.5.el7 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | jenkins-0:2.263.3.1612434332-1.el7 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | machine-config-daemon-0:4.5.0-202102050524.p0.git.2594.ff3b8c0.el8 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift-0:4.5.0-202102050524.p0.git.0.9229406.el7 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift-ansible-0:4.5.0-202102031005.p0.git.0.c6839a2.el7 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | openshift-clients-0:4.5.0-202102051529.p0.git.3612.61b096a.el7 | * |
| Red Hat OpenShift Container Platform 4.5 | RedHat | runc-0:1.0.0-72.rhaos4.5.giteadfc6b.el8 | * |
| Red Hat OpenShift Container Platform 4.6 | RedHat | jenkins-0:2.263.3.1612434510-1.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | atomic-openshift-service-idler-0:4.8.0-202106281541.p0.git.39cfc66.assembly.stream.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | butane-0:0.12.1-1.rhaos4.8.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | console-login-helper-messages-0:0.20.3-1.rhaos4.8.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | coreos-installer-0:0.9.0-6.rhaos4.8.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | cri-o-0:1.21.2-5.rhaos4.8.gitb27d974.el7 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | cri-tools-0:1.21.0-2.el7 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | haproxy-0:2.2.13-1.el7 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | ignition-0:2.9.0-6.rhaos4.8.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | ironic-images-0:2021.1-20210614.1.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | ironic-images-ipa-ppc64le-0:2021.1-20210614.1.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | ironic-images-ipa-x86_64-0:2021.1-20210614.1.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | jenkins-0:2.289.1.1624020353-1.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | jenkins-2-plugins-0:4.8.1624022417-1.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | kata-containers-0:2.1.0-4.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | openshift-0:4.8.0-202107161820.p0.git.051ac4f.assembly.stream.el7 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | openshift-ansible-0:4.8.0-202106281541.p0.git.626f7a3.assembly.stream.el7 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | openshift-clients-0:4.8.0-202106281541.p0.git.1077b05.assembly.stream.el7 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | openshift-kuryr-0:4.8.0-202106281541.p0.git.8a4c2d8.assembly.stream.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | openstack-ironic-1:17.0.4-0.20210713221218.a415e7e.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | openstack-ironic-inspector-0:10.6.1-0.20210406091336.579f59c.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | openstack-ironic-python-agent-0:7.0.2-0.20210611153100.bfa97cb.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | openvswitch2.15-0:2.15.0-9.el8fdp | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | ostree-0:2020.7-5.el8_4 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | ovn2.13-0:20.12.0-25.el8fdp | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | podman-0:3.0.1-6.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | python-debtcollector-0:2.2.0-0.20210324220630.649189d.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | python-eventlet-0:0.25.2-4.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | python-hardware-0:0.27.0-0.20210406121246.756fedb.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | python-ironic-lib-0:4.6.2-0.20210608101214.ca2e4ba.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | python-ironic-prometheus-exporter-0:2.2.1-0.20210325143713.70e39c8.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | python-jsonschema-0:3.2.0-5.el8ost | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | python-keystoneauth1-0:4.3.0-0.20210325001456.6a66271.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | python-kubernetes-0:12.0.1-1.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | python-openshift-1:0.12.1-1.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | python-openstacksdk-0:0.53.0-0.20210325011601.4629245.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | python-oslo-concurrency-0:4.4.0-0.20210325004915.7dcf9e9.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | python-oslo-config-2:8.5.0-0.20210325050501.cfa2564.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | python-oslo-context-0:3.2.0-0.20210325043103.0d02866.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | python-oslo-db-0:8.5.0-0.20210325041241.503db60.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | python-oslo-i18n-0:5.0.1-0.20210324221600.73187bd.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | python-oslo-log-0:4.4.0-0.20210409081224.9b29c90.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | python-oslo-policy-0:3.7.0-0.20210325051823.d853485.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | python-oslo-serialization-0:4.1.0-0.20210325012242.8445e61.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | python-oslo-service-0:2.5.0-0.20210325014731.d25e454.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | python-oslo-upgradecheck-0:1.3.0-0.20210325003851.9f95a6e.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | python-oslo-utils-0:4.8.0-0.20210325043201.3288539.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | python-pyrsistent-0:0.16.0-3.el8ost | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | python-stevedore-0:3.3.0-0.20210325001012.7d7154f.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | python-sushy-0:3.7.1-0.20210428165244.bc49878.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | python-sushy-oem-idrac-0:2.0.1-0.20210326152858.83b7eb0.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | python-tooz-0:2.8.0-0.20210324235001.54448e9.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | redhat-release-coreos-0:48.84-4.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | rteval-loads-0:1.4-12.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | runc-0:1.0.0-98.rhaos4.8.gitcd80260.el7 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | rust-afterburn-0:5.0.0-1.rhaos4.8.el8 | * |
| Red Hat OpenShift Container Platform 4.8 | RedHat | toolbox-0:0.0.8-3.rhaos4.8.el8 | * |
Potential Mitigations
- Follow the principle of least privilege when assigning access rights to entities in a software system.
- Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/132.html
- https://cwe.mitre.org/data/definitions/17.html
- https://cwe.mitre.org/data/definitions/35.html
- https://cwe.mitre.org/data/definitions/76.html