CVE-2020-2200

Root

Cause

The Jenkins Play Framework Plugin up to version 1.0.2 permits users to specify the path to the play command on the Jenkins master during form validation. This input is not sanitized, leading to an OS command injection vulnerability [1][2].

Exploitation

An attacker must be able to store a file (e.g., a malicious executable) on the Jenkins master. The attacker then supplies this file's path as the play command, causing the plugin to execute it during form validation. No special authentication is required beyond the ability to interact with the validation endpoint [1][2].

Impact

Successful exploitation allows arbitrary OS command execution on the Jenkins master with the privileges of the Jenkins process, potentially compromising the entire Jenkins environment and its managed nodes [1][2].

Mitigation

As of the advisory on 2020-06-03, the Play Framework Plugin had no fix released, and the vulnerability was unresolved [1][3]. Users should avoid using the plugin or ensure that only trusted users can store files on the master.