CVE-2014-2058 (Java, published 2014-10-17T15:55Z)
Description: value: BuildTrigger in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to bypass access restrictions and execute arbitrary jobs by configuring a job to trigger another job. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7330.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-264 \u2014 Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Repository: https://github.com/jenkinsci/jenkins
Files changed:
core/src/main/java/hudson/model/AbstractProject.java
test/src/test/java/hudson/tasks/BuildTriggerTest.java
Commit message: [FIXED SECURITY-109] SECURITY-55 fix to BuildTrigger configuration failed if downstream project was not visible.


Vulnerable code:
            for (AbstractProject downstream : t.getChildProjects(this)) {

Fixed code:
            List<AbstractProject> childProjects;
            SecurityContext orig = ACL.impersonate(ACL.SYSTEM);
            try {
                childProjects = t.getChildProjects(this);
            } finally {
                SecurityContextHolder.setContext(orig);
            }
            for (AbstractProject downstream : childProjects) {
import com.gargoylesoftware.htmlunit.FailingHttpStatusCodeException;
import com.gargoylesoftware.htmlunit.html.HtmlTextInput;
import hudson.model.Item;
import hudson.security.AuthorizationMatrixProperty;
import hudson.security.LegacySecurityRealm;
import hudson.security.Permission;
import hudson.security.ProjectMatrixAuthorizationStrategy;
import java.util.Collections;
import java.util.HashMap;
import java.util.Map;
import java.util.Set;
import jenkins.model.Jenkins;

    public void testConfigureDownstreamProjectSecurity() throws Exception {
        jenkins.setSecurityRealm(new LegacySecurityRealm());
        ProjectMatrixAuthorizationStrategy auth = new ProjectMatrixAuthorizationStrategy();
        auth.add(Jenkins.READ, "alice");
        jenkins.setAuthorizationStrategy(auth);
        FreeStyleProject upstream = createFreeStyleProject("upstream");
        Map<Permission,Set<String>> perms = new HashMap<Permission,Set<String>>();
        perms.put(Item.READ, Collections.singleton("alice"));
        perms.put(Item.CONFIGURE, Collections.singleton("alice"));
        upstream.addProperty(new AuthorizationMatrixProperty(perms));
        FreeStyleProject downstream = createFreeStyleProject("downstream");
        /* Original SECURITY-55 test case:
        downstream.addProperty(new AuthorizationMatrixProperty(Collections.singletonMap(Item.READ, Collections.singleton("alice"))));
        */
        WebClient wc = createWebClient();
        wc.login("alice");
        HtmlPage page = wc.getPage(upstream, "configure");
        HtmlForm config = page.getFormByName("config");
        config.getButtonByCaption("Add post-build action").click(); // lib/hudson/project/config-publishers2.jelly
        page.getAnchorByText("Build other projects").click();
        HtmlTextInput childProjects = config.getInputByName("buildTrigger.childProjects");
        childProjects.setValueAttribute("downstream");
        try {
            submit(config);
            fail();
        } catch (FailingHttpStatusCodeException x) {
            assertEquals(403, x.getStatusCode());
        }
        assertEquals(Collections.emptyList(), upstream.getDownstreamProjects());
    }