CVE-2019-16560

Vulnerability

Description

CVE-2019-16560 is a cross-site request forgery (CSRF) vulnerability in the Jenkins WebSphere Deployer Plugin, affecting versions 1.6.1 and earlier. The plugin fails to require a POST request for connection test form validation, allowing an attacker to craft a malicious link or page that, when visited by an authenticated Jenkins user with the necessary permissions, performs unintended actions without the user's consent [1][2][3].

Exploitation

An attacker can exploit this CSRF flaw by tricking an authenticated Jenkins user into clicking a specially crafted link or loading a malicious web page. The attacker does not need direct access to the Jenkins instance but must rely on social engineering or other methods to have the victim perform the action. The attack leverages the victim's session to send forged requests to the Jenkins server [1].

Impact

Successful exploitation allows an attacker to perform connection tests and determine whether files with an attacker-specified path exist on the Jenkins master file system. This information disclosure can aid in reconnaissance, helping an attacker map the file system structure or identify the presence of specific files, potentially escalating further attacks [1][3].

Mitigation

As of the Jenkins security advisory dated December 17, 2019, no fix was available for this plugin. The advisory notes the vulnerability as unresolved, meaning users may need to disable the plugin or apply workarounds until a patched version is released [1][2].