Bug 1471046 (CVE-2017-1000085)

Summary:	CVE-2017-1000085 jenkins-plugin-subversion: CSRF vulnerability and insufficient permission checks allow capturing credentials (SECURITY-303)
Product:	[Other] Security Response	Reporter:	Adam Mariš <amaris>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	ahardin, bleanhar, ccoleman, dedgar, dmcphers, eparis, jgoulding, jkeck, joelsmith, jokerman, kseifried, mchappel, tjay
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	jenkins-plugin-subversion 2.9	Doc Type:	If docs needed, set a value
Doc Text:	Subversion Plugin improperly checked permissions, requiring just Item/Build instead of Item/Configure when used. This allows a user to specify an attacker-controlled Subversion server which can then be used to collect credentials used by the Subversion plugin.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-08-14 16:43:15 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1472029
Bug Blocks:	1471067

Description Adam Mariš 2017-07-14 10:05:42 UTC

Subversion Plugin connects to a user-specified Subversion repository as part of form validation (e.g. to retrieve a list of tags).

This functionality improperly checked permissions, allowing any user with Item/Build permission (but not Item/Configure) to connect to any web server or Subversion server and send credentials with a known ID, thereby possibly capturing them.

Additionally, this functionality did not require POST requests be used, thereby allowing the above to be performed without direct access to Jenkins via Cross-Site Request Forgery attacks.

External References:

https://jenkins.io/security/advisory/2017-07-10/

Comment 1 Adam Mariš 2017-07-14 10:05:59 UTC

Acknowledgments:

Name: the Jenkins project
Upstream: Jesse Glick (CloudBees)

Comment 3 Trevor Jay 2017-08-14 16:43:15 UTC

Statement:

This issue affects the versions of jenkins-plugin-subversion as shipped with Red Hat OpenShift Enterprise 3. Red Hat Product Security has rated this issue as having Low security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.