CVE-2020-2272

Vulnerability

The Jenkins ElasTest Plugin versions 1.2.1 and earlier lack a permission check when connecting to external URLs. This allows any user with Overall/Read permission to trigger the plugin to connect to an attacker-specified URL using attacker-supplied credentials [1][2].

Exploitation

An attacker must have at least Overall/Read permission on a Jenkins instance, which is typically granted to low-privileged users. With that permission, the attacker can craft a request that causes the plugin to initiate a connection to any URL, including internal or external systems, using credentials of the attacker's choice. No other permissions are required.

Impact

Successful exploitation could allow an attacker to probe internal network resources, exfiltrate data, or perform other actions by leveraging the Jenkins server's network position. Since the plugin uses the attacker-provided credentials, it could also be used to attempt login on other services.

Mitigation

As of the advisory publication on 2020-09-16, the vulnerability remains unresolved and no patched version has been released [1][2]. Administrators should restrict Overall/Read permission to trusted users as a workaround.