CVE-2020-2159

Vulnerability

Overview CVE-2020-2159 is a command injection vulnerability in the Jenkins CryptoMove Plugin versions 0.1.33 and earlier [1]. The plugin fails to properly sanitize user-supplied input when configuring build steps, allowing attackers with Job/Configure permission to inject arbitrary operating system commands [2].

Exploitation

An attacker must have Job/Configure access to a Jenkins job. By crafting a malicious build configuration, they can execute arbitrary OS commands on the Jenkins master node. No additional authentication is required beyond the Jenkins credentials that grant the necessary permission. The attack can be performed remotely if the Jenkins instance is network-accessible [1].

Impact

Successful exploitation gives the attacker the ability to execute arbitrary commands as the OS user running Jenkins. This can lead to full compromise of the Jenkins master, including access to credentials, secrets, and the ability to pivot to other systems [2].

Mitigation

As of the March 2020 security advisory, no fixed version of the CryptoMove Plugin has been released [1][2]. The plugin is listed as an unresolved security issue. Administrators should restrict Job/Configure permissions to trusted users only, or remove the plugin entirely if it is not required.