Jenkins plugin Multiple Vulnerabilities (2026-03-18)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(302903);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/03/20");

  script_cve_id("CVE-2026-33001", "CVE-2026-33003", "CVE-2026-33004");
  script_xref(name:"JENKINS", value:"2026-03-18");
  script_xref(name:"IAVA", value:"2026-A-0255");

  script_name(english:"Jenkins plugin Multiple Vulnerabilities (2026-03-18)");

  script_set_attribute(attribute:"synopsis", value:
"An application running on a remote web server host is affected by multiple vulnerabilities");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version number, the version of Jenkins plugins running on the remote web server is
affected by multiple vulnerabilities:

  - Jenkins LoadNinja Plugin 2.1 and earlier stores LoadNinja API keys unencrypted in job config.xml files on
    the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to
    the Jenkins controller file system. (CVE-2026-33003)

  - Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the
    extraction of .tar and .tar.gz archives, allowing crafted archives to write files to arbitrary locations
    on the filesystem, restricted only by file system access permissions of the user running Jenkins. This can
    be exploited to deploy malicious scripts or plugins on the controller by attackers with Item/Configure
    permission, or able to control agent processes. (CVE-2026-33001)

  - Jenkins LoadNinja Plugin 2.1 and earlier does not mask LoadNinja API keys displayed on the job
    configuration form, increasing the potential for attackers to observe and capture them. (CVE-2026-33004)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://jenkins.io/security/advisory/2026-03-18");
  script_set_attribute(attribute:"solution", value:
"Update Jenkins plugins to the following versions:
  - LoadNinja Plugin to version 2.2 or later

See vendor advisory for more details.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-33001");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/03/18");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/03/18");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/03/18");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cloudbees:jenkins");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:jenkins:jenkins");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_set_attribute(attribute:"enable_cgi_scanning", value:"true");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("jenkins_plugins_detect.nbin", "jenkins_win_installed.nbin", "jenkins_nix_installed.nbin", "macosx_jenkins_installed.nbin");
  script_require_keys("installed_sw/Jenkins");

  exit(0);
}

include('vcf_extras.inc');

var constraints = [
    {'max_version' : '2.1', 'fixed_version' : '2.2', 'plugin' : 'LoadNinja Plugin'}
];

var app_info = vcf::jenkins::plugin::get_app_info(plugins:constraints);

vcf::jenkins::plugin::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_HOLE
);