Bug 1471050 (CVE-2017-1000089)

Summary: CVE-2017-1000089 jenkins-plugin-pipeline-build-step: Missing check of Item/Build permission (SECURITY-433)
Product: [Other] Security Response Reporter: Adam Mariš <amaris>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED WONTFIX QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: ahardin, bleanhar, ccoleman, dedgar, dmcphers, eparis, jgoulding, jkeck, joelsmith, jokerman, kseifried, mchappel, tjay
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: jenkins-plugin-pipeline-build-step 2.5.1 Doc Type: If docs needed, set a value
Doc Text:
The jenkins-plugin-pipeline-build-step fails to check permissions correctly allowing attackers with access to it to specify the triggering of any other project in Jenkins. This potentially gives an attacker access to projects they should not have access to.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2017-08-14 16:43:12 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1472030    
Bug Blocks: 1471067    

Description Adam Mariš 2017-07-14 10:12:03 UTC 
Builds in Jenkins are associated with an authentication that controls the permissions that the build has to interact with other elements in Jenkins. By default, builds run as SYSTEM and are unconstrained unless plugins implement specific additional permission checks.

Plugins like Authorize Project Plugin allow changing the authentication associated with a build.

The Pipeline: Build Step Plugin did not check the build authentication it was running as and allowed triggering any other project in Jenkins.

External References:

https://jenkins.io/security/advisory/2017-07-10/
Comment 1 Adam Mariš 2017-07-14 10:12:20 UTC 
Acknowledgments:

Name: the Jenkins project
Comment 3 Trevor Jay 2017-08-14 16:43:12 UTC 
Statement:

This issue affects the versions of jenkins-plugin-pipeline-build-step as shipped with Red Hat OpenShift Enterprise 3. Red Hat Product Security has rated this issue as having Low security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.