CVE-2019-1003015

Vulnerability

An XML external entity (XXE) processing vulnerability exists in Jenkins Job Import Plugin versions 2.1 and earlier. The flaw resides in the RestApiClient.java file at src/main/java/org/jenkins/ci/plugins/jobimport/client/RestApiClient.java. It is triggered when the plugin imports jobs from an external Jenkins server. An attacker who controls that server can include malicious XML with external entities in the response, leading to XXE processing on the Jenkins controller [1][2].

Exploitation

An attacker must be able to control the HTTP server that the Job Import Plugin queries during job import. This could be achieved by setting up a rogue Jenkins server or compromising an existing one. When the plugin makes a request to import jobs from that server, the attacker crafts a response containing an XML document with a malicious external entity. No additional authentication or permissions are required beyond the ability to influence the server response [1][2].

Impact

Successful exploitation allows the attacker to read arbitrary files from the Jenkins controller's file system, potentially exposing sensitive information such as credentials and configuration files. Additionally, the attacker can cause denial of service (DoS) by consuming resources through entity expansion or by causing the application to crash [1][2].

Mitigation

Jenkins has released a fix as part of the security advisory on 2019-01-28. Users should upgrade the Job Import Plugin to version 2.2 or later. No workaround is available for earlier versions [1][3].