-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIA Semantic Attack on Google Gemini - Read the Latest Research
A Semantic Attack on Google Gemini - Read the Latest Research
Miggo AI
Miggo AIRoot Cause AnalysisThe vulnerability is a path traversal in the Jenkins Redpen - Pipeline Reporter for Jira Plugin. The security advisory states that the plugin fails to properly validate the path of the workspace directory when uploading artifacts to Jira. Analysis of the source code, specifically RedpenJenkinsCore.java and RedpenService.java, confirms this flaw.
The execution flow starts at org.jenkinsci.plugins.redpen.service.RedpenJenkinsCore.doPerform, which is the main entry point and receives a ParameterModel object. An attacker with Item/Configure permission can manipulate the properties of this model, including the logAbsolutePath.
The doPerform method then calls the private addAttachments method. Inside addAttachments, the line File buildLogFile = new File(parameter.getLogAbsolutePath()); creates a File object using the user-controlled path without any validation to ensure it is within the Jenkins workspace. While other file attachment logic within the same method correctly performs path validation using startsWith(workspaceBasePath), this crucial validation is missing for the build log file.
Finally, this unvalidated File object is passed to org.jenkinsci.plugins.redpen.service.RedpenService.addAttachment. This service method proceeds to read the file from the filesystem and upload its contents to Jira. This allows an attacker to specify an arbitrary file path on the Jenkins controller (e.g., ../../../../../../etc/passwd) and have its contents uploaded to Jira, leading to information disclosure.
org.jenkinsci.plugins.redpen.service.RedpenJenkinsCore.doPerformsrc/main/java/org/jenkinsci/plugins/redpen/service/RedpenJenkinsCore.java
org.jenkinsci.plugins.redpen.service.RedpenJenkinsCore.addAttachmentssrc/main/java/org/jenkinsci/plugins/redpen/service/RedpenJenkinsCore.java
org.jenkinsci.plugins.redpen.service.RedpenService.addAttachmentsrc/main/java/org/jenkinsci/plugins/redpen/service/RedpenService.java
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkinsci.plugins:pipeline-reporter-by-redpen | maven | <= 1.054 |