Jenkins CLI Build Cancellation Permission Bypass

Executive Summary

This vulnerability in Jenkins allows attackers with Item/Build permission to cancel builds started by other users using the build CLI command with the -s flag. The system fails to check the Item/Cancel permission before allowing the cancellation.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability affects Jenkins CLI build commands with the -s flag. To detect it, check Jenkins logs for unauthorized build cancellations using commands like 'grep -r "cancel" /var/log/jenkins/jenkins.log' or review user permissions with 'java -jar jenkins-cli.jar -s http://localhost:8080/ list-jobs --username USER --password PASS' to identify suspicious activity.

Useful 0 Not Useful 0

Impact Analysis

Attackers could disrupt ongoing builds, potentially causing delays or loss of work for other users. It may lead to unauthorized interruption of critical build processes.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly impact compliance with standards like GDPR or HIPAA as it involves unauthorized build cancellation rather than data exposure or privacy violations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Jenkins to a version newer than 2.579 or LTS 2.568.2 to address the permission check issue in the build CLI command.

Useful 0 Not Useful 0