-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:windocks-start-container | maven | <= 1.4 |
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability exists within the WinDocksBuilder.java file of the Jenkins Start Windocks Containers Plugin. The analysis of the source code for version 1.4 reveals two key methods contributing to the vulnerability.
The primary entry point is the doFillImageItems method within the DescriptorImpl inner class. In Jenkins plugins, public methods starting with do in a Descriptor class are automatically exposed as HTTP endpoints. This specific method is intended to populate a list box in the UI. It accepts an ipaddress as a query parameter. Crucially, this method lacks any permission checks to verify if the user is authorized to perform this action, and it does not require the request to be a POST, leaving it open to Cross-Site Request Forgery (CSRF).
The doFillImageItems method then calls the GetImages method, passing the user-supplied ipaddress. The GetImages method directly uses this input to construct a URL (http://%s/images/json) and initiates an HTTP connection. This constitutes a Server-Side Request Forgery (SSRF) vulnerability, as an attacker can specify any IP address or hostname, causing the Jenkins server to make a request to an arbitrary destination.
An attacker can exploit this by crafting a malicious URL and tricking an authenticated Jenkins user into clicking it. This would cause the user's browser to send a GET request to the vulnerable endpoint, triggering the SSRF and making the Jenkins server connect to a URL of the attacker's choice.
windockspkg.windocksplug.WinDocksBuilder$DescriptorImpl.doFillImageItemssrc/main/java/windockspkg/windocksplug/WinDocksBuilder.java
windockspkg.windocksplug.WinDocksBuilder$DescriptorImpl.GetImagessrc/main/java/windockspkg/windocksplug/WinDocksBuilder.java
Ongoing coverage of React2Shell