CVE-2020-2138
📋 TL;DR
CVE-2020-2138 is an XML External Entity (XXE) vulnerability in Jenkins Cobertura Plugin versions 1.15 and earlier. It allows attackers to read arbitrary files from the Jenkins controller file system by exploiting improper XML parser configuration. This affects Jenkins instances using the vulnerable Cobertura Plugin.
💻 Affected Systems
- Jenkins Cobertura Plugin
📦 What is this software?
Cobertura by Jenkins
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of Jenkins controller through arbitrary file read, potentially leading to credential theft, configuration exposure, and lateral movement within the environment.
Likely Case
Unauthorized reading of sensitive files on the Jenkins controller, including credentials, configuration files, and source code.
If Mitigated
Limited impact with proper network segmentation and file system permissions, though sensitive data exposure remains possible.
🎯 Exploit Status
Exploitation requires ability to submit malicious Cobertura XML reports to Jenkins, typically requiring some level of access to the Jenkins instance.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Cobertura Plugin 1.16
Vendor Advisory: https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1700
Restart Required: Yes
Instructions:
1. Update Jenkins Cobertura Plugin to version 1.16 or later via Jenkins Plugin Manager. 2. Restart Jenkins service after update. 3. Verify plugin version in Jenkins plugin management interface.
🔧 Temporary Workarounds
Disable Cobertura Plugin
allTemporarily disable the vulnerable plugin if immediate patching is not possible
Navigate to Jenkins > Manage Jenkins > Manage Plugins > Installed tab > Find Cobertura Plugin > Disable
Restrict XML Processing
allConfigure XML parser security features if custom XML processing is used
Set XML parser properties: FEATURE_SECURE_PROCESSING=true, DISALLOW_DOCTYPE_DECL=true
🧯 If You Can't Patch
- Implement strict network access controls to limit Jenkins controller exposure
- Apply file system permissions to restrict sensitive file access from Jenkins process
🔍 How to Verify
Check if Vulnerable:
Check Jenkins plugin manager for Cobertura Plugin version. If version is 1.15 or earlier and plugin is enabled, the system is vulnerable.Check Version:
Check via Jenkins web interface: Manage Jenkins > Manage Plugins > Installed tab > Cobertura PluginVerify Fix Applied:
Verify Cobertura Plugin version is 1.16 or later in Jenkins plugin management interface.📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns in Jenkins logs
- Errors related to XML parsing of Cobertura reports
- Failed attempts to parse malformed XML
Network Indicators:
- Unusual XML payloads in HTTP POST requests to Jenkins
- Requests containing external entity references in XML
SIEM Query:
source="jenkins.log" AND ("XML parsing error" OR "DOCTYPE" OR "ENTITY" OR "file://")