CSRF vulnerability in Jenkins Swarm Plugin
Date: 2022-05
Affected: maven/org.jenkins-ci.plugins:swarm
Attack vector: auth-bypass
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2020-2191
CVE-2020-2192
CVE-2020-2197
CVE-2020-2198
CWE: CWE-285
CWE-352
CWE-522
CVSS: 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L)

Swarm Plugin adds API endpoints to add or remove agent labels. In Swarm Plugin 3.20 and earlier these only require a global Swarm secret to use, and no regular permission check is performed. This allows users with Agent/Create permission to add or remove labels of any agent. Additionally, these API endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability. Swarm Plugin 3.21 requires POST requests and Agent/Configure permission for the affected agent to these endpoints. It no longer uses the global Swarm secret for these API endpoints.


Mitigations:

Architectural layers (MAESTRO):