CVE-2019-1003081

Vulnerability

The Jenkins OpenShift Deployer Plugin contains a missing permission check in the DeployApplication.DeployApplicationDescriptor#doCheckLogin form validation method [1][3]. This flaw allows any user with Overall/Read permission to trigger a connection from the Jenkins controller to an attacker-specified server. The vulnerability affects all versions of the plugin prior to the fix; the affected versions include those before 1.0.4 [1].

Exploitation

An attacker with Overall/Read permission can craft a request to the doCheckLogin endpoint, supplying a server URL of their choice. The plugin will then initiate an outbound connection from the Jenkins controller to that URL [3]. No additional authentication or user interaction is required beyond the initial permission.

Impact

Successful exploitation allows the attacker to force the Jenkins controller to connect to an arbitrary external or internal server. This can be used for server-side request forgery (SSRF) attacks, network reconnaissance, or to probe internal services that are not directly accessible [1][3]. The attacker does not gain direct code execution or data modification on the Jenkins controller.

Mitigation

The vulnerability is fixed in OpenShift Deployer Plugin version 1.0.4, released as part of the Jenkins Security Advisory on 2019-04-03 [1]. Users should upgrade to this version or later. No workarounds are documented; upgrading is the recommended action.