CVE-2020-2268

Root

Cause

The Jenkins MongoDB Plugin up to version 1.3 lacks cross-site request forgery (CSRF) protection. This allows an attacker to trick a Jenkins administrator or user with the necessary permissions into performing unintended actions without their knowledge.

Exploitation

An attacker can craft a malicious web page or link that, when clicked by an authenticated Jenkins user, triggers a forged request to the Jenkins controller. No authentication is required for the attacker beyond luring a logged-in user to interact with the malicious content. The attack leverages the user's session to execute the CSRF payload.

Impact

Successful exploitation enables the attacker to access metadata of arbitrary files stored on the Jenkins controller. This includes information about file paths, sizes, and timestamps. While the plugin does not expose the file contents themselves, the metadata leak can aid in reconnaissance or further attacks.

Mitigation

The vulnerability is addressed in the Jenkins Security Advisory published on September 16, 2020 [1]. The advisory lists the MongoDB Plugin among several plugins with unresolved security issues, meaning a fix has not been released for the MongoDB Plugin as of the advisory date [2]. Administrators should consider disabling the plugin if not in use or apply available workarounds such as restricting access to the Jenkins controller [1][2].