CVE-2020-2160: CSRF
First published: Wed Mar 25 2020(Updated: )
An extension point in Jenkins allows selectively disabling cross-site request forgery (CSRF) protection for specific URLs. Implementations of that extension point received a different representation of the URL path than the Stapler web framework uses to dispatch requests in Jenkins 2.227 and earlier, LTS 2.204.5 and earlier. This discrepancy allowed attackers to craft URLs that would bypass the CSRF protection of any target URL. Jenkins now uses the same representation of the URL path to decide whether CSRF protection is needed for a given URL as the Stapler web framework uses. In case of problems, administrators can disable this security fix by setting the system property `hudson.security.csrf.CrumbFilter.UNPROCESSED_PATHINFO` to `true`. As an additional safeguard, semicolon (`;`) characters in the path part of a URL are now banned by default. Administrators can disable this protection by setting the system property `jenkins.security.SuspiciousRequestFilter.allowSemicolonsInPath` to `true`.
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/jenkins | ||
| Jenkins Jenkins | <=2.204.5 | |
| Jenkins Jenkins | <=2.227 | |
| maven/org.jenkins-ci.main:jenkins-core | >=2.205<=2.227 | 2.228 |
| maven/org.jenkins-ci.main:jenkins-core | <=2.204.5 | 2.204.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://security-tracker.debian.org/tracker/CVE-2020-2160
- http://www.openwall.com/lists/oss-security/2020/03/25/2
- https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1774
- https://nvd.nist.gov/vuln/detail/CVE-2020-2160
- https://github.com/jenkinsci/jenkins/commit/f7cf28355973df1ca6eb19066370bf70b10742f7
- https://github.com/advisories/GHSA-c735-g9f2-2mvp (Advisory)
- https://github.com/jenkinsci/jenkins/commit/f479652171f4ab854747de64b22bf59adb35fb8f
- collector/security-tracker-debian
- collector/nvd-index
- collector/nvd-api
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-c735-g9f2-2mvp
- alias/CVE-2020-2160
- agent/software-canonical-lookup
- agent/weakness
- agent/severity
- agent/author
- agent/last-modified-date
- agent/references
- agent/event
- collector/nvd-cve
- source/NVD
- collector/github-advisory
- agent/tags
- agent/description
- collector/mitre-cve
- source/MITRE
- package-manager/debian
- vendor/jenkins
- canonical/jenkins jenkins
- version/jenkins jenkins/2.204.5
- version/jenkins jenkins/2.227
- package-manager/maven