CVE-2019-16546

Vulnerability

Overview

CVE-2019-16546 is a security flaw in the Jenkins Google Compute Engine Plugin, versions 4.1.1 and earlier. The plugin does not verify SSH host keys when connecting to agents it creates, a critical omission that undermines the security of SSH-based connections. By skipping host key verification, the plugin cannot authenticate the identity of the remote agent, leaving the connection vulnerable to interception and impersonation [1][2].

Attack

Vector and Exploitation

An attacker with network access to the communication path between a Jenkins controller and a Google Compute Engine agent can exploit this weakness through a man-in-the-middle (MITM) attack. Without host key verification, the attacker can interpose themselves between the controller and the agent, presenting a forged host key. Because the plugin does not validate the key against a known set of trusted keys, it will accept the connection as legitimate, allowing the attacker to intercept, modify, or inject data in transit [1][2][3].

Impact

Successful exploitation enables the attacker to eavesdrop on all communications between Jenkins and the agent, potentially gaining access to sensitive build data, credentials, and configuration details. Moreover, the attacker could inject malicious commands or modify build artifacts, leading to arbitrary code execution on the Jenkins controller or on the agent machines. The impact is considered high, as it compromises the integrity and confidentiality of Jenkins operations [1][2].

Mitigation

The issue was addressed in Google Compute Engine Plugin version 4.2.0, released on November 21, 2019, alongside several other security fixes for Jenkins plugins [1][3]. Users should immediately upgrade the plugin to version 4.2.0 or later. There is no workaround short of disabling the plugin; therefore, upgrading is strongly recommended to prevent MITM attacks.