CVE-2019-10369

Vulnerability

Overview

CVE-2019-10369 is a missing permission check in the Jenkins JClouds Plugin versions 2.14 and earlier. The flaw exists in the BlobStoreProfile.DescriptorImpl#doTestConnection and JCloudsCloud.DescriptorImpl#doTestConnection methods, which do not properly verify that the user has the required permissions to perform connection tests. This allows users with only Overall/Read access to invoke these methods, bypassing the intended authorization checks [1][2].

Exploitation

An attacker must first obtain valid credentials IDs stored in Jenkins, which could be achieved through other vulnerabilities or information disclosure. With Overall/Read access, the attacker can then use the test connection functionality to connect to an attacker-specified URL using those credentials IDs. The plugin will attempt the connection and, in doing so, capture the credentials, making them available to the attacker [1]. The attack does not require any additional privileges beyond Overall/Read, making it a low-barrier exploitation path.

Impact

Successful exploitation allows an attacker to capture credentials stored in Jenkins, such as passwords, API tokens, or SSH keys. This can lead to further compromise of Jenkins and connected systems. The vulnerability is rated as Medium severity (CVSS score not explicitly provided in references, but described as Medium in the advisory) [1][3].

Mitigation

The issue is fixed in JClouds Plugin version 2.15. Users are strongly advised to upgrade to this version or later. No workaround is mentioned in the advisory, but administrators should ensure that only trusted users have Overall/Read access and monitor for suspicious test connection attempts [1][2].