SB2022102133 - Multiple vulnerabilities in Jenkins Compuware Topaz for Total Test plugin

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Missing Authorization (CVE-ID: CVE-2022-43427)

The vulnerability allows a remote attacker to bypass authorization checks.

The vulnerability exists due to the affected plugin does not perform permission checks in several HTTP endpoints. A remote user can enumerate credentials IDs of credentials stored in Jenkins.

2) XML External Entity injection (CVE-ID: CVE-2022-43430)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied XML input. A remote user can pass a specially crafted XML code to the affected application and view contents of arbitrary files on the system or initiate requests to external systems.

Successful exploitation of the vulnerability may allow an attacker to view contents of arbitrary file on the server or perform network scanning of internal and external infrastructure.

3) Protection Mechanism Failure (CVE-ID: CVE-2022-43429)

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient implementation of security measures within the "GetRemoteUTF8FileContents". A remote attacker can read arbitrary files on the Jenkins controller file system.

4) Protection Mechanism Failure (CVE-ID: CVE-2022-43428)

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient implementation of security measures within the "RemoteSystemProperties". A remote attacker can obtain the values of Java system properties from the Jenkins controller process.

Remediation

Install update from vendor's website.

References

• https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2623
• http://www.openwall.com/lists/oss-security/2022/10/19/3
• https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2625
• https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2624