CVE-2020-2160: CSRF
An extension point in Jenkins allows selectively disabling cross-site request forgery (CSRF) protection for specific URLs.
Implementations of that extension point received a different representation of the URL path than the Stapler web framework uses to dispatch requests in Jenkins 2.227 and earlier, LTS 2.204.5 and earlier. This discrepancy allowed attackers to craft URLs that would bypass the CSRF protection of any target URL.
Jenkins now uses the same representation of the URL path to decide whether CSRF protection is needed for a given URL as the Stapler web framework uses.
In case of problems, administrators can disable this security fix by setting the system property hudson.security.csrf.CrumbFilter.UNPROCESSEDPATHINFO to true.
As an additional safeguard, semicolon (;) characters in the path part of a URL are now banned by default. Administrators can disable this protection by setting the system property jenkins.security.SuspiciousRequestFilter.allowSemicolonsInPath to true.
Other sources
Jenkins 2.227 and earlier, LTS 2.204.5 and earlier uses different representations of request URL paths, which allows attackers to craft URLs that allow bypassing CSRF protection of any target URL.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.jenkins-ci.main:jenkins-coreto a version that resolves this vulnerability.Fixed in 2.228 - Upgrade
Upgrade
maven/org.jenkins-ci.main:jenkins-coreto a version that resolves this vulnerability.Fixed in 2.204.6 - Configuration
Ensure the system property hudson.security.csrf.CrumbFilter.UNPROCESSED_PATHINFO is not set to true (keep it false) so the CSRF security fix that aligns URL path representation remains enabled.
Jenkins (CSRF protection) hudson.security.csrf.CrumbFilter.UNPROCESSED_PATHINFO = false - Configuration
Ensure the system property jenkins.security.SuspiciousRequestFilter.allowSemicolonsInPath is not set to true so semicolon (;) characters in the URL path remain banned by default.
Jenkins (Suspicious Request Filter) jenkins.security.SuspiciousRequestFilter.allowSemicolonsInPath = false
Event History
Frequently Asked Questions
Can CVE-2020-2160 be exploited remotely?
Yes, CVE-2020-2160 can be exploited remotely by an attacker to disable CSRF protection on specific URLs.