CVE-2019-1003087

Vulnerability

The Jenkins Chef Sinatra Plugin has a missing permission check in the ChefBuilderConfiguration.DescriptorImpl#doTestConnection form validation method. This allows users with Overall/Read permission to trigger a connection to an attacker-specified server. Affected versions include all versions of the plugin up to and including the version before the fix, as noted in the Jenkins security advisory [1][3].

Exploitation

An attacker with Overall/Read permission can invoke the doTestConnection method via the Jenkins API or UI. By specifying a malicious server address, the plugin will attempt to establish a connection to that server. No additional privileges are required [1][3].

Impact

Successful exploitation allows an attacker to cause the Jenkins controller to connect to an arbitrary server. This can be leveraged for server-side request forgery (SSRF), potentially exposing internal network services or leaking sensitive information. The impact depends on the target server's responsiveness and the network configuration [1][3].

Mitigation

The Jenkins Security Advisory 2019-04-03 recommends updating the Chef Sinatra Plugin to the latest version. While no specific fixed version is mentioned in the available references, users should upgrade to the most recent plugin release. No workarounds are documented [1].