RCE vulnerability in ElasticBox Jenkins Kubernetes CI/CD Plugin
Date: 2022-05
Affected: maven/com.elasticbox.jenkins-ci.plugins:kubernetes-ci
Attack vector: rce
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2020-2211
CVE-2020-2213
CWE: CWE-256
CWE-502
CWE-522
CVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

ElasticBox Jenkins Kubernetes CI/CD Plugin 1.3 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types. This results in a remote code execution (RCE) vulnerability exploitable by users able to provide YAML input files to ElasticBox Jenkins Kubernetes CI/CD Plugin’s build step.


Mitigations:

Architectural layers (MAESTRO):