How to Fix CorePlague Vulnerabilities in Jenkins Server And Update Center?

Cloud security firm Aqua has uncovered two critical security vulnerabilities in Jenkins, an open-source automation server that could potentially allow an attacker to execute arbitrary code on targeted systems and sometimes a complete compromise too. These flaws, known as CVE-2023-27898 and CVE-2023-27905, collectively referred to as CorePlague, affect the Jenkins server and Update Center and can impact all Jenkins versions prior to 2.319.2. Considering the critical nature of these vulnerabilities, we urge all users of Jenkin to fix CorePlague vulnerabilities in Jenkins Server And Update Center.

We created this post in which we covered the introduction of Jenkins, where the flaws stemmed from, how can an attacker can compromise the Jenkins Server and Update Center, versions vulnerable to these critical flaws, and finally, how to fix CorePlague vulnerabilities in Jenkins Server And Update Center. Let’s begin with the introduction of Jenkins.

A Short Introduction About Jenkins

Jenkins is an open-source automation server widely used for continuous integration and continuous delivery. It is written in Java and helps developers quickly build, test, and deploy applications. Jenkins can be installed on-premise or hosted in the cloud, making it a great choice for both small and large development teams. With its user-friendly interface, Jenkins allows users to easily set up configurations and automate the process of building, testing and deploying software. It also provides a host of other features, such as integration with version control systems, continuous delivery pipelines, and security settings. Jenkins is an essential tool for any DevOps team striving for efficient workflows and improved application performance.

To better understand CorePlague Vulnerabilities in Jenkins Server and Update Center, it is good to know some basic Jenkins components like Artifactory Binary Repository, Jenkins Update Center, and Jenkins Pluginsthat.

Artifactory Binary Repository: An artifact registry, also known as a binary repository manager, is used to store and manage software artifacts such as libraries, packages, and plugins. The Jenkins project has its own Artifactory binary repository, which distributes core, library, and plugin releases. This allows developers to easily access and share artifacts and ensures the consistency and integrity of the software being used.

Jenkins Update Center: The Jenkins Update Center is a key component of the Jenkins automation server that provides access to a wide range of plugins and updates for the Jenkins platform. It allows administrators to discover, download, install, and upload their plugins that extend the functionality of their Jenkins server. This is also known as Jenkins community update sites, where developers and users can contribute their own plugins and enhancements.

Jenkins Plugins: Plugins are software components that extend the functionality of the Jenkins Server, enabling users to enhance and customize their experience and the automation process. These plugins offer features such as source code management, build triggers, notification mechanisms, and integrations with external tools and systems. They can be installed, updated, and managed via the Jenkins Update Center. With over 1,500 plugins available, Jenkins offers a wide range of functionalities and integrations that can be tailored to specific development needs.

Now itCVE-2023-27898’s time to see the summary of the CorePlague Vulnerabilities.

Summary of CorePlague Vulnerabilities in Jenkins Server And Update Center

CorePlague vulnerabilities are composed of two critical vulnerabilities identified as CVE-2023-27898 and CVE-2023-27905. When these vulnerabilities are chained together, they allow an attacker to execute arbitrary code on targeted systems. Sometimes, these vulnerabilities allow a complete compromise of the Jenkins server, giving an attacker full control. Let’s see the summary of both vulnerabilities in the next section.

Summary of CVE-2023-27898:

Stored XSS in Jenkins Plugin System

CVE-2023-27898 is a high-severity Storred Cross-Site Scripting(XSS) vulnerability in Jenkins 2.270 through 2.393 and LTS 2.277.1 through 2.375.3, which could allow an attacker to execute arbitrary code on the affected system. Aqua published this vulnerability on March 8, 2023, marking its severity as High with a CVSS score of 8.8 out of 10 on the scale.