CVE-2018-1000015

Vulnerability

The Pipeline: Nodes and Processes plugin versions 2.17 and earlier incorrectly perform permission checks when executing node blocks. On Jenkins instances using the Authorize Project plugin, the authentication associated with a build may lack the Computer/Build permission on some agents. Despite this lack of permission, the node block is allowed to execute due to the flawed checks. [1][2]

Exploitation

An attacker with the ability to create or trigger a Pipeline job can include a node block targeting an agent for which the build's authentication does not have the Computer/Build permission. The incorrect permission validation in the plugin fails to prevent the execution, allowing the attacker to run builds on agents they are not authorized to use. [2]

Impact

Successful exploitation allows the attacker to execute Pipeline node blocks on agents where they lack the required permission. This can lead to unauthorized access to sensitive data, code execution on those agents, and potential lateral movement within the Jenkins environment. [1][2]

Mitigation

The vulnerability is fixed in Pipeline: Nodes and Processes plugin version 2.18 and later. Jenkins users should update the plugin to the latest version to enforce proper permission checks. No workaround is available. [2]