-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability lies in a missing permission check and CSRF protection in an HTTP endpoint of the Nexus Task Runner Plugin. The security advisory states that this allows attackers with 'Overall/Read' permission to make Jenkins connect to an arbitrary URL with specified credentials. Since no patch is available, I analyzed the source code of the latest vulnerable version (0.9.2). In Jenkins plugins, HTTP endpoints for UI interactions like 'Test Connection' buttons are typically implemented as do... methods in a Descriptor class. I identified the doTestConnection method in NexusTaskRunner.DescriptorImpl as the vulnerable function. This method takes a nexusUrl and credentialsId as parameters, does not perform any permission checks before using them to establish a connection, and is not annotated with @RequirePOST to prevent CSRF attacks. This perfectly aligns with the details provided in the security advisory.
org.jenkinsci.plugins.nexustaskrunner.NexusTaskRunner$DescriptorImpl.doTestConnectionsrc/main/java/org/jenkinsci/plugins/nexustaskrunner/NexusTaskRunner.java
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:nexus-task-runner | maven | <= 0.9.2 |
Ongoing coverage of React2Shell