CVE-2023-32992: CSRF
Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier does not perform permission checks in multiple HTTP endpoints.
This allows attackers with Overall/Read permission to send an HTTP request to an attacker-specified URL and parse the response as XML, or parse a local file on the Jenkins controller as XML.
As the plugin does not configure its XML parser to prevent XML external entity (XXE) attacks, attackers can have Jenkins parse a crafted XML response that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
SAML Single Sign On(SSO) Plugin 2.1.0 requires POST requests and Overall/Administer permission for the affected HTTP endpoints.
Other sources
Missing permission checks in Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier allow attackers with Overall/Read permission to send an HTTP request to an attacker-specified URL and parse the response as XML, or parse a local file on the Jenkins controller as XML.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/io.jenkins.plugins:miniorange-saml-spto a version that resolves this vulnerability.Fixed in 2.1.0 - Upgrade
Upgrade
Jenkins SAML Single Sign On(SSO) Pluginto a version that resolves this vulnerability.Fixed in 2.1.0 - Configuration
Update affected HTTP endpoints to require POST requests (Jenkins SAML Single Sign On(SSO) Plugin 2.1.0 requires POST requests for the impacted endpoints).
Jenkins SAML Single Sign On(SSO) Plugin HTTP method requirement for affected endpoints = POST only - Configuration
Ensure affected HTTP endpoints perform permission checks requiring Overall/Administer permission (as in Jenkins SAML Single Sign On(SSO) Plugin 2.1.0).
Jenkins SAML Single Sign On(SSO) Plugin authorization/permission checks for affected endpoints = Overall/Administer
Event History
Frequently Asked Questions
What is the severity of CVE-2023-32992?
CVE-2023-32992 is classified as a high severity vulnerability due to its potential for unauthorized access and data exposure.
How do I fix CVE-2023-32992?
To mitigate CVE-2023-32992, upgrade the Jenkins SAML Single Sign On Plugin to version 2.0.3 or later.
What type of attack does CVE-2023-32992 enable?
CVE-2023-32992 allows attackers to perform unauthorized XML parsing of responses from specified URLs or local files.
Which versions of the Jenkins SAML Single Sign On Plugin are affected by CVE-2023-32992?
CVE-2023-32992 affects Jenkins SAML Single Sign On Plugin versions 2.0.2 and earlier.
What permissions are required to exploit CVE-2023-32992?
Exploitation of CVE-2023-32992 requires an attacker to have Overall/Read permissions on the Jenkins server.