GHSA-7c44-m589-36w7

Jenkins Convert To Pipeline Plugin vulnerable to command injection

Source: GitHub Advisory Database (reviewed) High CVE-2023-28677

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:convert-to-pipeline	<= 1.0	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Convert To Pipeline Plugin 1.0 and earlier uses basic string concatenation to convert Freestyle projects' Build Environment, Build Steps, and Post-build Actions to the equivalent Pipeline step invocations. This allows attackers able to configure Freestyle projects to prepare a crafted configuration that injects Pipeline script code into the (unsandboxed) Pipeline resulting from a conversion by Convert To Pipeline Plugin. If an administrator converts the Freestyle project to a Pipeline, the script will be pre-approved.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-28677 advisory
https://github.com/jenkinsci/convert-to-pipeline-plugin package
https://www.jenkins.io/security/advisory/2023-03-21/#SECURITY-2966 web