CVE-2019-10331

Vulnerability

Overview

CVE-2019-10331 is a cross-site request forgery (CSRF) vulnerability in the Jenkins ElectricFlow Plugin versions 1.1.5 and earlier. The doTestConnection method in the Configuration class did not require POST requests or perform any CSRF token validation, allowing attackers to trick Jenkins users into executing unintended actions [2].

Exploitation

To exploit this vulnerability, an attacker must craft a malicious web page or link that, when visited by an authenticated Jenkins user with sufficient permissions (Overall/Read access), triggers a request to the Jenkins server. This request causes the vulnerable method to connect to an attacker-specified URL using attacker-supplied credentials [2]. No additional authentication is required beyond the victim's session.

Impact

Successful exploitation enables an attacker to perform server-side request forgery (SSRF) attacks. The attacker can make Jenkins connect to internal or external resources, potentially accessing sensitive data or services that are otherwise inaccessible. Additionally, the attacker-controlled credentials could be used to authenticate to other systems if leaked [2].

Mitigation

The vulnerability has been fixed in ElectricFlow Plugin version 1.1.7 [3]. Users are strongly advised to upgrade to the latest version. No workarounds are documented. This CVE is listed as part of a broader security advisory affecting multiple Jenkins plugins [2].