CVE-2019-10332

Vulnerability

Description CVE-2019-10332 is a missing permission check vulnerability in the Jenkins ElectricFlow Plugin (formerly CloudBees CD Plugin) versions 1.1.5 and earlier. The plugin's Configuration#doTestConnection method did not verify that the user had the necessary permissions to perform the connection test. This allowed any user with Overall/Read access to execute a connection test to an arbitrary URL using attacker-supplied credentials [1][2].

Attack

Vector and Requirements An attacker with Overall/Read access to Jenkins could exploit this flaw by crafting a malicious request to the doTestConnection endpoint. The attack requires no special privileges beyond the default read access and can be performed remotely over the network. The plugin would then attempt to connect to the attacker-controlled URL using the provided credentials, potentially leaking sensitive information or enabling further attacks [2][3].

Impact

Successful exploitation allows an attacker to perform server-side request forgery (SSRF) by making the Jenkins server connect to an arbitrary URL. This could be used to probe internal network services, access cloud metadata endpoints, or capture credentials if the attacker-controlled server logs authentication attempts. The missing permission check increases the attack surface for users with limited access [2].

Mitigation

The vulnerability is fixed in ElectricFlow Plugin version 1.1.7. Users should upgrade to this version or later. Administrators should also review their Jenkins instance for any indications of misuse and ensure that only trusted users have Overall/Read access [2][3].