The Story, The Findings And The Fixes Behind More Than A 100 Jenkins Plugins Vulnerabilities

The Story, The Findings And
The Fixes Behind More Than
A 100 Jenkins Plugins
Vulnerabilities
Viktor Gazdag

© 2019 All Rights Reserved. 2
Timeline
• Who Am I
• Goal Of The Talk
• Statistics
• The Story
• The Findings
• The Fixes
• Report Vulnerability
• Related Articles
• Q&A

Who Am I
• Security Consultant at NCC Group
• IT Helpdesk, System Administrator, System Engineer
• Ethical Hacking Specialist, Security Consultant
• 2019 Jenkins Security MVP
• CRT, OSCP, eWPT, eWPTX, eMAPT
• MCSE 2012, NS0-155
• Travel, Video Games, Security Research

Thank You
• Jenkins / CloudBees - Daniel Beck
• NCC Group - Matt Lewis, Mario Iregui, Bernardo Damele, Jennifer Fernick,
Simon Harraghy, Balazs Bucsay
• Irene Michlin, Soroush Dalili

Goal Of The Talk
• Why – Give Back To The Community, Raise Awareness
• How – Show The Problems And Fixes
• What – Presentation, Blog, Advisories, White Paper*, Tool*

Core and Plugin Vulnerabilities By Years
• Core And Plugins
• SECURITY-* And CVE-*
0
50
100
150
200
250
300
350
2010 2011 2012 2013 2014 2015 2016 2017 2018 2019
Vulnerabilities and Advisories By Year
Vulnerability Advisory

The Story
• Started With A Project
• Continued With A Jenkins Advisory
• Triggered By A Second Advisory

The Findings
• Credentials Stored In Plain Text, CSRF, SSRF, XSS,
TLS Certificate Validation Disabled, Missing
Permission Check
• 15 Advisories, 128 Jenkins Plugin Vulnerabilities and
1 Core Vulnerability, 118 CVEs, 1 CVE Pending, 10
Issues Without CVEs

Distribution Of The Vulnerability Types
Submitted And Released Findings (2017.11 – 2019.10)
0
10
20
30
40
50
60
70
80
Credentials stored plain
text
CSRF Missing permission check SSRF with permission
check
CSRF with permission
check
TLS certificate validation
disabled
XSS
Core and Plugin Vulnerabilities

Findings - Tools
• Black Box Test
• Burp Suite Pro
• Linux
• netcat, cat, less, ls, openssl, python,
vi
• Simple Python program with Self-
Signed SSL Certificate
• Browser
• Looked For Specific Issues

The Findings
• Credentials Stored In Plain Text

The Findings
• Web Form

The Findings

The Findings
• Multiple Path
• /var/lib/Jenkins/*.xml

The Findings

The Findings
• Multiple Path
• /var/lib/Jenkins/job/TestJob/con
fig.xml

The Findings
• Missing Permission Check

The Findings
• Cross-Site Request Forgery
(CSRF) And Missing Permission
Check Allowed Capturing
Credentials
• “CSRF is an attack that forces
an end user to execute
unwanted actions on a web
application in which they're
currently authenticated.” -
OWASP

The Findings
• CSRF And Missing Permission Check
Allowed Capturing Credentials

The Findings
• CSRF And Missing Permission Check Allowed Capturing Credentials

The Findings
• CSRF And Missing Permission
Check Allowed Capturing
Credentials

The Findings
• CSRF And Missing Permission Check
Allowed Capturing Credentials

The Findings
Check Lead to Server-Side
Request Forgery (SSRF)
• “In a SSRF attack the attacker
can change a parameter used
on the web application to
create or control requests from
the vulnerable server.” -
Netsparker

The Findings
Check Lead to SSRF

The Findings
• Cross-Site Scripting (XSS)
• Reflected, Stored, DOM
• “XSS attacks are a type of injection, in which malicious scripts are injected into
otherwise benign and trusted websites.” - OWASP

The Findings
• XSS

The Fixes

The Fixes
• Using a Secret Type Offered By Jenkins
• 3rd Party Plugin Called Credentials Plugin

The Fixes

The Fixes
• CSRF

The Fixes
• Missing Permission Check

The Fixes
• XSS

Report Vulnerability
• Where To Report:
• Jenkins: https://jenkins.io/security/
• CloudBees: https://www.cloudbees.com/security-policy
• Jenkins JIRA: https://issues.jenkins-ci.org/browse/SECURITY
• Include The Following:
• Check Previous Issues: https://jenkins.io/security/advisories/
• Core And Plugin Version
• Description
• Reproduction Steps
• Proof Of Concept (Screenshots, Console Outputs etc.)
• Deadline (Optional)

Related Articles
• Storing Secret:
• On Disk And Configuration Forms: https://jenkins.io/doc/developer/security/secrets/
• CSRF:
• Form Validation And CSRF: https://jenkins.io/doc/developer/security/form-validation/
• XSS:
• XSS Prevention: https://jenkins.io/doc/developer/security/xss-prevention/
• Other:
• Blog Post: https://www.nccgroup.trust/uk/about-us/newsroom-and-
events/blogs/2019/may/story-of-a-hundred-vulnerable-jenkins-plugins/
• Teaser Blog Post: https://jenkins.io/blog/2019/11/29/do-plugins-store-credentials-in-a-
secure-way/
• Technical Advisory: https://www.nccgroup.trust/uk/our-research/jenkins-plugins-and-core-
technical-summary-advisory/?research=Technical+advisories

Questions
Feel Free To Ask Personally
Email viktor.gazdag@nccgroup.com

The Story, The Findings And The Fixes Behind More Than A 100 Jenkins Plugins Vulnerabilities

Recommended

More Related Content

Similar to The Story, The Findings And The Fixes Behind More Than A 100 Jenkins Plugins Vulnerabilities (20)

Recently uploaded (20)

The Story, The Findings And The Fixes Behind More Than A 100 Jenkins Plugins Vulnerabilities