CVE-2020-2196
📋 TL;DR
CVE-2020-2196 is a Cross-Site Request Forgery (CSRF) vulnerability in Jenkins Selenium Plugin that allows attackers to perform administrative actions without proper authentication. This affects all Jenkins instances using Selenium Plugin version 3.141.59 or earlier. Attackers can exploit this to manipulate Selenium configurations and potentially compromise Jenkins environments.
💻 Affected Systems
- Jenkins Selenium Plugin
📦 What is this software?
Selenium by Jenkins
⚠️ Risk & Real-World Impact
Worst Case
Attackers could reconfigure Selenium settings, execute arbitrary browser automation, steal credentials, or pivot to other systems through the Jenkins environment.
Likely Case
Attackers would manipulate Selenium test configurations, potentially leading to data exposure or disruption of automated testing processes.
If Mitigated
With proper network segmentation and access controls, impact would be limited to the Selenium testing environment only.
🎯 Exploit Status
CSRF attacks require the victim to be authenticated to Jenkins, but exploitation is straightforward once that condition is met.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.141.59.1
Vendor Advisory: https://jenkins.io/security/advisory/2020-06-03/#SECURITY-1766
Restart Required: Yes
Instructions:
1. Update Jenkins Selenium Plugin to version 3.141.59.1 or later via Jenkins Plugin Manager. 2. Restart Jenkins service. 3. Verify the plugin version in Jenkins plugin management interface.
🔧 Temporary Workarounds
Disable Selenium Plugin
allTemporarily disable the vulnerable plugin if immediate patching is not possible
Navigate to Jenkins > Manage Jenkins > Manage Plugins > Installed tab > Find Selenium Plugin > Disable
Implement CSRF Protection Proxy
allUse a reverse proxy or WAF to add CSRF protection headers
🧯 If You Can't Patch
- Restrict network access to Jenkins to trusted IP addresses only
- Implement strict access controls and monitor for unusual Selenium configuration changes
🔍 How to Verify
Check if Vulnerable:
Check Jenkins plugin manager for Selenium Plugin version. If version is 3.141.59 or earlier, the system is vulnerable.Check Version:
Check via Jenkins web interface: Manage Jenkins > Manage Plugins > Installed tab > Find Selenium PluginVerify Fix Applied:
Verify Selenium Plugin version is 3.141.59.1 or later in Jenkins plugin management interface.📡 Detection & Monitoring
Log Indicators:
- Unusual Selenium configuration changes
- CSRF token validation failures
- Unauthorized access attempts to Selenium endpoints
Network Indicators:
- HTTP POST requests to /selenium/* endpoints without proper CSRF tokens
- Unusual traffic patterns to Jenkins Selenium endpoints
SIEM Query:
source="jenkins.log" AND ("Selenium" AND "configuration" AND "changed") OR ("CSRF" AND "validation" AND "failed")🔗 References
- http://www.openwall.com/lists/oss-security/2020/06/03/3
- http://www.openwall.com/lists/oss-security/2022/04/14/2
- https://jenkins.io/security/advisory/2020-06-03/#SECURITY-1766
- http://www.openwall.com/lists/oss-security/2020/06/03/3
- http://www.openwall.com/lists/oss-security/2022/04/14/2
- https://jenkins.io/security/advisory/2020-06-03/#SECURITY-1766
