GHSA-jx7x-rf3f-j644

Jenkins CloudBees CD Plugin vulnerable to arbitrary file deletion

Source: GitHub Advisory Database (reviewed) High CVE-2023-46654

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:electricflow	< 1.1.33	1.1.33

Details

As written in the advisory (Markdown source, shown as plain text).

In Jenkins CloudBees CD Plugin, artifacts that were previously copied from an agent to the controller are deleted after publishing by the 'CloudBees CD - Publish Artifact' post-build step. CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations outside of the expected directory during this cleanup process. This allows attackers able to configure jobs to delete arbitrary files on the Jenkins controller file system. CloudBees CD Plugin 1.1.33 deletes symbolic links without following them.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-46654 advisory
https://github.com/jenkinsci/electricflow-plugin/commit/e45ca8428ae45f45ca07611e802eaa0f1484ab50 web
https://github.com/jenkinsci/electricflow-plugin package
https://www.jenkins.io/security/advisory/2023-10-25/#SECURITY-3237 web
http://www.openwall.com/lists/oss-security/2023/10/25/2 web