CVE-2016-3721: Code Injection
Jenkins before 2.3 and LTS before 1.651.2 might allow remote authenticated users to inject arbitrary build parameters into the build environment via environment variables.
Other sources
The following flaw was found in Jenkins:
Build parameters in Jenkins typically are passed to build scripts as environment variables. Some plugins allow passing arbitrary (undeclared) parameters. Depending on access permissions and installed plugins, malicious users were able to trigger builds, passing arbitrary environment variables (e.g. PATH) to modify the behavior of those builds. Rather than expect all plugin authors to be aware of this potential problem, Jenkins now filters the build parameters based on what is defined on the job.
As this change is known to affect a number of plugins, it's possible to restore the previous behavior by setting the system property hudson.model.ParametersAction.keepUndefinedParameters to true. This is potentially very unsafe and intended as a short-term workaround only.
To allow specific, known safe parameter names to be passed to builds, set the system property hudson.model.ParametersAction.safeParameters to a comma-separated list of safe parameter names. Example:
java -Dhudson.model.ParametersAction.safeParameters=FOO,BARBAZ,qux -jar jenkins.war
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-05-11
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-3721?
CVE-2016-3721 is considered a medium severity vulnerability due to the potential for arbitrary code injection by remote authenticated users.
How do I fix CVE-2016-3721?
To fix CVE-2016-3721, upgrade Jenkins to version 2.3 or later, or LTS version 1.651.2 or later.
Who is affected by CVE-2016-3721?
CVE-2016-3721 affects Jenkins users running versions prior to 2.3 and LTS versions prior to 1.651.2.
What type of vulnerability is CVE-2016-3721?
CVE-2016-3721 is a code injection vulnerability that allows remote authenticated users to inject arbitrary build parameters.
Can CVE-2016-3721 be exploited without authentication?
No, CVE-2016-3721 requires an attacker to be a remote authenticated user to exploit the vulnerability.