CVE-2019-10368

Vulnerability

Overview

CVE-2019-10368 is a cross-site request forgery (CSRF) vulnerability in the Jenkins JClouds Plugin versions 2.14 and earlier. The flaw exists in the BlobStoreProfile.DescriptorImpl#doTestConnection and JCloudsCloud.DescriptorImpl#doTestConnection methods, which lack a proper permission check and CSRF protection. This allows an attacker to craft a malicious request that, when executed by an authenticated Jenkins user, can connect to an attacker-specified URL using attacker-specified credential IDs [1][2].

Exploitation

Prerequisites

To exploit this vulnerability, an attacker must first obtain valid credential IDs stored in Jenkins, which could be achieved through another vulnerability or information disclosure. The attacker then needs to trick a user with at least Overall/Read access into performing an action (e.g., clicking a link) that triggers the CSRF request. No additional authentication is required beyond the victim's session [1].

Impact

Successful exploitation allows the attacker to capture credentials stored in Jenkins by having the victim's browser connect to an attacker-controlled server with the specified credential IDs. This can lead to the compromise of sensitive credentials used for cloud services and other integrations [1][2].

Mitigation

The vulnerability is fixed in JClouds Plugin version 2.15, released on August 7, 2019. Users are advised to upgrade immediately. No workaround is available for earlier versions [1][2].