[SECURITY] Use HTTPS to resolve dependencies in Maven Build #768

JLLeitschuh · 2020-02-11T02:15:46Z

This is a security fix for a vulnerability in your Apache Maven pom.xml file(s).

The build files indicate that this project is resolving dependencies over HTTP instead of HTTPS.
This leaves your build vulnerable to allowing a Man in the Middle (MITM) attackers to execute arbitrary code on your or your computer or CI/CD system.

This vulnerability has a CVSS v3.0 Base Score of 8.1/10.

POC code has existed since 2014 to maliciously compromise a JAR file in-flight.
MITM attacks against HTTP are increasingly common, for example Comcast is known to have done it to their own users.

This contribution is a part of a submission to the GitHub Security Lab Bug Bounty program.

Detecting this and Future Vulnerabilities

This vulnerability was automatically detected by LGTM.com using this CodeQL Query.

As of September 2019 LGTM.com and Semmle are officially a part of GitHub.

You can automatically detect future vulnerabilities like this by enabling the free (for open-source) LGTM App.

I'm not an employee of GitHub nor of Semmle, I'm simply a user of LGTM.com and an open-source security researcher.

Source

Yes, this contribution was automatically generated, however, the code to generate this PR was lovingly hand crafted to bring this security fix to your repository.

The source code that generated and submitted this PR can be found here:
JLLeitschuh/bulk-security-pr-generator

Opting-Out

If you'd like to opt-out of future automated security vulnerability fixes like this, please consider adding a file called
.github/GH-ROBOTS.txt to your repository with the line:

User-agent: JLLeitschuh/bulk-security-pr-generator
Disallow: *

This bot will respect the ROBOTS.txt format for future contributions.

Alternatively, if this project is no longer actively maintained, consider archiving the repository.

CLA Requirements

This section is only relevant if your project requires contributors to sign a Contributor License Agreement (CLA) for external contributions.

It is unlikely that I'll be able to directly sign CLAs. However, all contributed commits are already automatically signed-off.

The meaning of a signoff depends on the project, but it typically certifies that committer has the rights to submit this work under the same license and agrees to a Developer Certificate of Origin
(see https://developercertificate.org/ for more information).

- Git Commit Signoff documentation

If signing your organization's CLA is a strict-requirement for merging this contribution, please feel free to close this PR.

Tracking

All PR's generated as part of this fix are tracked here:
JLLeitschuh/bulk-security-pr-generator#2

Merge in latest from jenkinsci

github -> GitHub

This fixes a security vulnerability in this project where the `pom.xml` files were configuring Maven to resolve dependencies over HTTP instead of HTTPS. Signed-off-by: Jonathan Leitschuh <[email protected]>

samrocketman

This PR is unlikely to get merged. I recommend going through my comments and opening pull requests to smaller parts or updating this PR with recommended changes.

samrocketman · 2020-04-25T15:50:23Z

pom.xml

        </pluginRepository>
    </pluginRepositories>

    <distributionManagement>
        <repository>
            <id>maven.jenkins-ci.org</id>
-            <url>http://maven.jenkins-ci.org:8081/content/repositories/releases/</url>
+            <url>https://maven.jenkins-ci.org:8081/content/repositories/releases/</url>


This would not work. You can't switch to HTTPS and keep the port 8081.

Recommendation

Update the parent pom for jenkinsci and remove repositories from this pom entirely. Plugin poms should not need to be referencing repositories.

samrocketman · 2020-04-25T15:51:28Z

src/main/resources/org/jenkinsci/plugins/ghprb/GhprbTrigger/config.groovy

@@ -8,7 +8,7 @@ f.entry(field: "gitHubAuthId", title:_("GitHub API credentials")) {
 f.entry(field: "adminlist", title: _("Admin list")) {
  f.textarea(default: descriptor.adminlist) 
 }
-f.entry(field: "useGitHubHooks", title: "Use github hooks for build triggering") {
+f.entry(field: "useGitHubHooks", title: "Use GitHub hooks for build triggering") {


Changes like this could be broken out into a separate pull request. Don't mix changes if you're proposing a large change. This change isn't large but just general advice.

Recommendation

You can leave this. However, if you're interested in getting changes like this out faster than what is blocked by this pull request I recommend opening a separate pull request.

samrocketman · 2020-04-25T15:54:39Z

README.md

@@ -1,3 +1,5 @@
+**NOTE**: this plugin is currently maintained at https://github.com/jenkinsci/ghprb-plugin


Why this note? GHPRB has a Jira project as well.

https://issues.jenkins-ci.org/browse/JENKINS-55793?jql=project%20%3D%20JENKINS%20AND%20status%20in%20(Open%2C%20%22In%20Progress%22%2C%20Reopened)%20AND%20component%20%3D%20ghprb-plugin%20ORDER%20BY%20created%20DESC

At this point it's hard to stop using either without a migration because there's many good reports in both locations.

Recommendation

Delete this line. Alternate recommendation, create a "Filing support issues" section and mention both GitHub issues and JIRA.

samrocketman · 2020-04-25T15:56:01Z

...TEMPLATE/don-t-create-issues-here--go-to-https---github.aaakk.us.kg-jenkinsci-ghprb-plugin-issues.md

+
+---
+
+### To report issues, go to the project location at https://github.com/jenkinsci/ghprb-plugin/issues


What is this file? It doesn't look like it provides anything beneficial to the project because

We're on GitHub.

GitHub issues are pretty standard across all GitHub projects unless it is disabled.

For projects that have GitHub issues disabled, they usually reference where issues are tracked off-site in the README.

As mentioned earlier, there's also GHPRB Jira tracker https://issues.jenkins-ci.org/browse/JENKINS-55793?jql=project%20%3D%20JENKINS%20AND%20status%20in%20(Open%2C%20%22In%20Progress%22%2C%20Reopened)%20AND%20component%20%3D%20ghprb-plugin%20ORDER%20BY%20created%20DESC

Recommendation

Delete this file.

JLLeitschuh · 2020-05-27T11:09:56Z

I have no idea how my bot ended up generating such a wild diff.

I'm not currently able to fix this. Please feel free to close this.

I do reccomend still fixing the security issue in the POM files though

DavidTanner and others added 10 commits February 5, 2016 07:00

Merge pull request jenkinsci#387 from jenkinsci/master

7fc283a

Merge in latest from jenkinsci

Merge branch 'master' of github.com:jenkinsci/ghprb-plugin

6f86b1a

Merge branch 'master' of github.com:jenkinsci/ghprb-plugin

69ff3ca

github -> GitHub

8021a3b

Merge pull request jenkinsci#418 from ssk2/fix-case

f0799bb

github -> GitHub

Update README.md

c305775

Update issue templates

cded567

Update issue templates

0087e77

Delete custom.md

d706c58

Use HTTPS instead of HTTP to resolve dependencies

aa27e06

This fixes a security vulnerability in this project where the `pom.xml` files were configuring Maven to resolve dependencies over HTTP instead of HTTPS. Signed-off-by: Jonathan Leitschuh <[email protected]>

JLLeitschuh force-pushed the fix/JLL/use_https_to_resolve_dependencies branch from 823255c to aa27e06 Compare February 11, 2020 05:41

samrocketman requested changes Apr 25, 2020

View reviewed changes

bitwiseman mentioned this pull request Jul 13, 2020

Update to use github-api 1.114.2 #788

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[SECURITY] Use HTTPS to resolve dependencies in Maven Build #768

[SECURITY] Use HTTPS to resolve dependencies in Maven Build #768

JLLeitschuh commented Feb 11, 2020

samrocketman left a comment

samrocketman Apr 25, 2020 •

edited

Loading

samrocketman Apr 25, 2020 •

edited

Loading

samrocketman Apr 25, 2020 •

edited

Loading

samrocketman Apr 25, 2020 •

edited

Loading

JLLeitschuh commented May 27, 2020

		@@ -1,3 +1,5 @@
		NOTE: this plugin is currently maintained at https://github.com/jenkinsci/ghprb-plugin


		---

		### To report issues, go to the project location at https://github.com/jenkinsci/ghprb-plugin/issues

[SECURITY] Use HTTPS to resolve dependencies in Maven Build #768

Are you sure you want to change the base?

[SECURITY] Use HTTPS to resolve dependencies in Maven Build #768

Conversation

JLLeitschuh commented Feb 11, 2020

Detecting this and Future Vulnerabilities

Source

Opting-Out

CLA Requirements

Tracking

samrocketman left a comment

Choose a reason for hiding this comment

samrocketman Apr 25, 2020 • edited Loading

Choose a reason for hiding this comment

Recommendation

samrocketman Apr 25, 2020 • edited Loading

Choose a reason for hiding this comment

Recommendation

samrocketman Apr 25, 2020 • edited Loading

Choose a reason for hiding this comment

Recommendation

samrocketman Apr 25, 2020 • edited Loading

Choose a reason for hiding this comment

Recommendation

JLLeitschuh commented May 27, 2020

samrocketman Apr 25, 2020 •

edited

Loading

samrocketman Apr 25, 2020 •

edited

Loading

samrocketman Apr 25, 2020 •

edited

Loading

samrocketman Apr 25, 2020 •

edited

Loading