CVE-2023-32991: CSRF
A cross-site request forgery (CSRF) vulnerability in Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier allows attackers to send an HTTP request to an attacker-specified URL and parse the response as XML, or parse a local file on the Jenkins controller as XML.
Other sources
Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier does not perform permission checks in multiple HTTP endpoints.
This allows attackers with Overall/Read permission to send an HTTP request to an attacker-specified URL and parse the response as XML, or parse a local file on the Jenkins controller as XML.
As the plugin does not configure its XML parser to prevent XML external entity (XXE) attacks, attackers can have Jenkins parse a crafted XML response that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
SAML Single Sign On(SSO) Plugin 2.1.0 requires POST requests and Overall/Administer permission for the affected HTTP endpoints.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/io.jenkins.plugins:miniorange-saml-spto a version that resolves this vulnerability.Fixed in 2.1.0 - Upgrade
Upgrade
Jenkins SAML Single Sign On (SSO) Pluginto a version that resolves this vulnerability.Fixed in 2.1.0 - Configuration
Upgrade to 2.1.0 so the affected HTTP endpoints require POST requests and enforce Overall/Administer permission checks (instead of allowing non-POST requests and lacking permission checks in multiple endpoints in 2.0.2 and earlier).
Jenkins SAML Single Sign On (SSO) Plugin HTTP endpoints HTTP method requirement and permission checks = POST required and requires Overall/Administer permission
Event History
Frequently Asked Questions
What is the severity of CVE-2023-32991?
CVE-2023-32991 is considered a critical vulnerability due to its potential for cross-site request forgery (CSRF) attacks.
How do I fix CVE-2023-32991?
To fix CVE-2023-32991, upgrade the Jenkins SAML Single Sign On Plugin to version 2.1.0 or later.
What versions are affected by CVE-2023-32991?
CVE-2023-32991 affects Jenkins SAML Single Sign On Plugin versions 2.0.2 and earlier.
What kind of attacks does CVE-2023-32991 enable?
CVE-2023-32991 enables attackers to send unauthorized HTTP requests to specified URLs and parse responses as XML.
Is CVE-2023-32991 specific to any particular Jenkins setup?
CVE-2023-32991 is a general vulnerability affecting any Jenkins instance using the vulnerable SAML Single Sign On Plugin.