Vulnerabilities > CVE-2017-2603 - Information Exposure vulnerability in Jenkins

047910
CVSS 3.5 - LOW
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
SINGLE
Confidentiality impact
PARTIAL
Integrity impact
NONE
Availability impact
NONE
network
jenkins
CWE-200
nessus

Summary

Jenkins before versions 2.44, 2.32.2 is vulnerable to a user data leak in disconnected agents' config.xml API. This could leak sensitive data such as API tokens (SECURITY-362).

Vulnerable Configurations

Part Description Count
Application
Jenkins
1505

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Subverting Environment Variable Values
    The attacker directly or indirectly modifies environment variables used by or controlling the target software. The attacker's goal is to cause the target software to deviate from its expected operation in a manner that benefits the attacker.
  • Footprinting
    An attacker engages in probing and exploration activity to identify constituents and properties of the target. Footprinting is a general term to describe a variety of information gathering techniques, often used by attackers in preparation for some attack. It consists of using tools to learn as much as possible about the composition, configuration, and security mechanisms of the targeted application, system or network. Information that might be collected during a footprinting effort could include open ports, applications and their versions, network topology, and similar information. While footprinting is not intended to be damaging (although certain activities, such as network scans, can sometimes cause disruptions to vulnerable applications inadvertently) it may often pave the way for more damaging attacks.
  • Exploiting Trust in Client (aka Make the Client Invisible)
    An attack of this type exploits a programs' vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by placing themselves in the communication channel between client and server such that communication directly to the server is possible where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
  • Browser Fingerprinting
    An attacker carefully crafts small snippets of Java Script to efficiently detect the type of browser the potential victim is using. Many web-based attacks need prior knowledge of the web browser including the version of browser to ensure successful exploitation of a vulnerability. Having this knowledge allows an attacker to target the victim with attacks that specifically exploit known or zero day weaknesses in the type and version of the browser used by the victim. Automating this process via Java Script as a part of the same delivery system used to exploit the browser is considered more efficient as the attacker can supply a browser fingerprinting method and integrate it with exploit code, all contained in Java Script and in response to the same web page request by the browser.
  • Session Credential Falsification through Prediction
    This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.

Nessus

  • NASL familyCGI abuses
    NASL idJENKINS_SECURITY_ADVISORY_2017-02-01.NASL
    descriptionThe remote web server hosts a version of Jenkins that is prior to 2.44, or a version of Jenkins LTS prior to 2.32.2, or else a version of Jenkings Opertations Center that is 1.625.x.y prior to 1.625.22.1, 2.7.x.0.y prior to 2.7.22.0.1, or 2.x.y.x prior to 2.32.2.1, or else a version of Jenkins Enterprise that is 1.651.x.y prior to 1.651.22.1, 2.7.x.0.y prior to 2.7.22.0.1, or 2.x.y.z prior to 2.32.2.1. It is, therefore, affected by the following vulnerabilities : - A DOM-based cross-site scripting (XSS) vulnerability exists in jQuery Core due to improper validation of certain tags while being rendered using innerHTML. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary script code in the user
    last seen2020-06-01
    modified2020-06-02
    plugin id97609
    published2017-03-08
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/97609
    titleJenkins < 2.44 / 2.32.x < 2.32.2, Jenkins Operations Center < 1.625.22.1 / 2.7.22.0.1 / 2.32.2.1, and Jenkins Enterprise < 1.651.22.1 / 2.7.22.0.1 / 2.32.2.1 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(97609);
      script_version("1.11");
      script_cvs_date("Date: 2019/06/10 11:30:32");
    
      script_cve_id(
        "CVE-2011-4969",
        "CVE-2015-0886",
        "CVE-2016-9887",
        "CVE-2017-2598",
        "CVE-2017-2599",
        "CVE-2017-2600",
        "CVE-2017-2601",
        "CVE-2017-2602",
        "CVE-2017-2603",
        "CVE-2017-2604",
        "CVE-2017-2605",
        "CVE-2017-2606",
        "CVE-2017-2607",
        "CVE-2017-2608",
        "CVE-2017-2609",
        "CVE-2017-2610",
        "CVE-2017-2611",
        "CVE-2017-2612",
        "CVE-2017-2613",
        "CVE-2017-1000362"
      );
      script_bugtraq_id(
        58458,
        95948,
        95949,
        95951,
        95952,
        95953,
        95954,
        95955,
        95956,
        95957,
        95959,
        95960,
        95961,
        95962,
        95963,
        95964,
        95967
      );
    
      script_name(english:"Jenkins < 2.44 / 2.32.x < 2.32.2, Jenkins Operations Center < 1.625.22.1 / 2.7.22.0.1 / 2.32.2.1, and Jenkins Enterprise < 1.651.22.1 / 2.7.22.0.1 / 2.32.2.1 Multiple Vulnerabilities");
      script_summary(english:"Checks the Jenkins version.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote web server hosts a job scheduling and management system
    that is affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The remote web server hosts a version of Jenkins that is prior to
    2.44, or a version of Jenkins LTS prior to 2.32.2, or else a version
    of Jenkings Opertations Center that is 1.625.x.y prior to 1.625.22.1,
    2.7.x.0.y prior to 2.7.22.0.1, or 2.x.y.x prior to 2.32.2.1, or else a
    version of Jenkins Enterprise that is 1.651.x.y prior to 1.651.22.1,
    2.7.x.0.y prior to 2.7.22.0.1, or 2.x.y.z prior to 2.32.2.1. It is,
    therefore, affected by the following vulnerabilities :
    
      - A DOM-based cross-site scripting (XSS) vulnerability
        exists in jQuery Core due to improper validation of
        certain tags while being rendered using innerHTML. An
        unauthenticated, remote attacker can exploit this, via
        a specially crafted request, to execute arbitrary script
        code in the user's browser session. (CVE-2011-4969)
    
      - An integer overflow condition exists in jBCrypt in the
        key stretching implementation in gensalt, within the
        crypt_raw() function, which is triggered when the
        'log_rounds' parameter is set to the maximum value (31).
        An unauthenticated, remote attacker can exploit this to
        cause log_rounds to perform zero rounds, allowing a
        brute-force attack to more easily determine the password
        hash. (CVE-2015-0886)
    
      - A cross-site request forgery vulnerability (XSRF) exists
        due to several URLs related to group and role management
        not requiring POST form submission. An unauthenticated,
        remote attacker can exploit this to create unused roles,
        delete unused roles, and set group descriptions. Note
        that only Jenkins Enterprise is affected by this issue.
        (CVE-2016-9887)
    
      - A flaw exists when sensitive data, such as passwords, is
        encrypted using AES-128 with electronic codebook mode
        (ECB). An authenticated, remote attacker can exploit
        this to disclose information about reused passwords.
        (CVE-2017-2598)
    
      - An unspecified flaw exists that is triggered when
        handling new items due to insufficient permission
        checks. An authenticated, remote attacker can exploit
        this, by using the name of an already existing item, to
        create a new item that overwrites the existing item or
        to gain access to related objects. (CVE-2017-2599)
    
      - An information disclosure vulnerability exists due to
        improper permissions being set for accessing node
        monitor data via the remote API. An authenticated,
        remote attacker can exploit this to disclose system
        configuration and runtime information. (CVE-2017-2600)
    
      - A stored cross-site scripting (XSS) vulnerability exists
        due to improper validation of input to names and
        descriptions fields before returning it to users. An
        authenticated, remote attacker can exploit this, via a
        specially crafted request, to execute arbitrary script
        code in a user's browser session. (CVE-2017-2601)
    
      - A flaw exists in the Agent-to-Master Security Subsystem
        because build metadata from the Pipeline suite is not
        properly blacklisted. An authenticated, remote attacker
        can exploit this to overwrite metadata files.
        (CVE-2017-2602)
    
      - A flaw exists in the config.xml API when handling
        user-initiated agent disconnects, which results in User
        objects being included in the agent API output. An
        authenticated, remote attacker can exploit this to
        disclose sensitive information (e.g., user API tokens).
        (CVE-2017-2603)
    
      - A flaw exists when handling permissions for
        administrative monitors that allows an authenticated,
        remote attacker to access certain provided actions.
        (CVE-2017-2604)
    
      - A flaw exists in the Re-Key Admin Monitor when
        re-encrypting secrets with a new key that results in old
        secrets, including the encryption key, being stored
        with world-readable permissions. A local attacker can
        exploit this to disclose sensitive information from the
        backup files. (CVE-2017-2605)
    
      - A flaw exists in the internal API, specifically within
        the Jenkins::getItems() function, when requesting a list
        of items via UnprotectedRootAction. An authenticated,
        remote attacker can exploit this to disclose information
        regarding otherwise restricted items. (CVE-2017-2606)
    
      - A stored cross-site scripting (XSS) vulnerability exists
        due to improper validation of input passed via
        serialized console notes before returning it to users in
        build logs. An authenticated, remote attacker can
        exploit this, via a specially crafted request, to
        execute arbitrary script code in a user's browser
        session. (CVE-2017-2607)
    
      - A flaw exists in the XStream-based API due to improper
        validation of user-supplied input before it is
        deserialized. An authenticated, remote attacker can
        exploit this, via a specially crafted request, to
        execute arbitrary code. (CVE-2017-2608)
    
      - A flaw exists in the search box implementation due to
        the autocompletion feature displaying the names of
        restricted views. An authenticated, remote attacker can
        exploit this to disclose sensitive names of views.
        (CVE-2017-2609)
    
      - A stored cross-site scripting (XSS) vulnerability exists
        due to improper validation of input passed in user names
        before returning it to users. An authenticated, remote
        attacker can exploit this, via a specially crafted
        request, to execute arbitrary script code in a user's
        browser session. (CVE-2017-2610)
    
      - A flaw exists due to improper validation of permissions
        to the /workspaceCleanup and /fingerprintCleanup URLs.
        An authenticated, remote attacker can exploit this to
        cause a high load on the master and agents.
        (CVE-2017-2611)
    
      - A flaw exists due to a failure to properly restrict
        access to JDK download credentials. An authenticated,
        remote attacker can exploit this to overwrite the
        credentials, thereby causing builds to fail.
        (CVE-2017-2612)
    
      - A cross-site request forgery (XSRF) vulnerability exists
        due to a failure by HTTP GET requests to /user to
        require multiple steps, explicit confirmation, or a
        unique token when performing certain sensitive actions.
        An unauthenticated, remote attacker can exploit this, by
        convincing a user to follow a specially crafted link, to
        cause the creation of new temporary users.
        (CVE-2017-2613)
    
      - An information disclosure vulnerability which exists in 
        its re-key admin monitor component due to world readable 
        permissions being set on the directory it creates to 
        store secret information. An unauthenticated, remote 
        attacker can exploit this to disclose information 
        contained in this directory.
        (CVE-2017-1000362)");
    
      script_set_attribute(attribute:"see_also", value:"https://jenkins.io/security/advisory/2017-02-01/");
      script_set_attribute(attribute:"see_also", value:"https://www.cloudbees.com/cloudbees-security-advisory-2017-02-01");
      script_set_attribute(attribute:"see_also", value:"https://jenkins.io/changelog/");
      script_set_attribute(attribute:"see_also", value:"https://jenkins.io/changelog-stable/");
      script_set_attribute(attribute:"solution", value:
    "Upgrade Jenkins to version 2.44 or later, Jenkins LTS to version
    2.32.2 or later, or Jenkins Operations Center to version 1.625.22.1 /
    2.7.22.0.1 / 2.32.2.1 or later, or Jenkins Enterprise to version
    1.651.22.1 / 2.7.22.0.1 / 2.32.2.1 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-2608");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2011/07/29");
      script_set_attribute(attribute:"patch_publication_date", value:"2017/02/01");
      script_set_attribute(attribute:"plugin_publication_date", value:"2017/03/08");
    
      script_set_attribute(attribute:"plugin_type", value:"remote");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:cloudbees:jenkins");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"CGI abuses");
    
      script_copyright(english:"This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("jenkins_detect.nasl");
      script_require_ports("Services/www", 8080);
      script_require_keys("installed_sw/Jenkins");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("http.inc");
    include("install_func.inc");
    
    app = "Jenkins";
    get_install_count(app_name:app, exit_if_zero:TRUE);
    
    port = get_http_port(default:8080);
    
    install = get_single_install(
      app_name : app,
      port     : port,
      exit_if_unknown_ver : TRUE
    );
    
    dir = install['path'];
    version = install['version'];
    edition = install['Edition'];
    app = app + " " + edition;
    install_url = build_url(port:port, qs:dir);
    fix = NULL;
    
    if (edition == "Enterprise")
    {
      if ( version =~ "^1\." )
        fix = "1.651.22.1";
      else if ( version =~ "^2\.7\.(\d)+\.0\." )
        fix = "2.7.22.0.1";
      else
        fix = "2.32.2.1";
    }
    else if (edition == "Operations Center")
    {
      if ( version =~ "^1\." )
        fix = "1.625.22.1";
      else if ( version =~ "^2\.7\.(\d)+\.0\." )
        fix = "2.7.22.0.1";
      else
        fix = "2.32.2.1";
    }
    else if (edition == "Open Source LTS")
    {
      fix = '2.32.2';
    }
    else if (edition == "Open Source")
    {
      fix = '2.44';
    }
    
    if (isnull(fix))
      audit(AUDIT_WEB_APP_NOT_AFFECTED, app, install_url, version);
    
    if (ver_compare(ver:version, fix:fix, strict:FALSE) < 0)
    {
      order = make_list("URL", "Product", "Version", "Fixed Version");
      report = make_array(
        order[0], install_url,
        order[1], app,
        order[2], version,
        order[3], fix
      );
      report = report_items_str(report_items:report, ordered_fields:order);
    
      security_report_v4(port:port, severity:SECURITY_WARNING, extra:report, xss:TRUE, xsrf:TRUE);
    }
    else audit(AUDIT_WEB_APP_NOT_AFFECTED, app, install_url, version);
    
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_5CFA9D0C73D74642AF4F28FBED9E9404.NASL
    descriptionJenkins Security Advisory : Please reference CVE/URL list for details
    last seen2020-06-01
    modified2020-06-02
    plugin id96939
    published2017-02-02
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/96939
    titleFreeBSD : jenkins -- multiple vulnerabilities (5cfa9d0c-73d7-4642-af4f-28fbed9e9404)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from the FreeBSD VuXML database :
    #
    # Copyright 2003-2019 Jacques Vidrine and contributors
    #
    # Redistribution and use in source (VuXML) and 'compiled' forms (SGML,
    # HTML, PDF, PostScript, RTF and so forth) with or without modification,
    # are permitted provided that the following conditions are met:
    # 1. Redistributions of source code (VuXML) must retain the above
    #    copyright notice, this list of conditions and the following
    #    disclaimer as the first lines of this file unmodified.
    # 2. Redistributions in compiled form (transformed to other DTDs,
    #    published online in any format, converted to PDF, PostScript,
    #    RTF and other formats) must reproduce the above copyright
    #    notice, this list of conditions and the following disclaimer
    #    in the documentation and/or other materials provided with the
    #    distribution.
    # 
    # THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS"
    # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
    # THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
    # PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS
    # BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
    # OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
    # OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
    # BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
    # WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
    # OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,
    # EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(96939);
      script_version("3.9");
      script_cvs_date("Date: 2019/07/10 16:04:13");
    
      script_cve_id("CVE-2011-4969", "CVE-2015-0886", "CVE-2017-2598", "CVE-2017-2599", "CVE-2017-2600", "CVE-2017-2601", "CVE-2017-2602", "CVE-2017-2603", "CVE-2017-2604", "CVE-2017-2605", "CVE-2017-2606", "CVE-2017-2607", "CVE-2017-2608", "CVE-2017-2609", "CVE-2017-2610", "CVE-2017-2611", "CVE-2017-2612", "CVE-2017-2613");
    
      script_name(english:"FreeBSD : jenkins -- multiple vulnerabilities (5cfa9d0c-73d7-4642-af4f-28fbed9e9404)");
      script_summary(english:"Checks for updated packages in pkg_info output");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote FreeBSD host is missing one or more security-related
    updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Jenkins Security Advisory :
    
    Please reference CVE/URL list for details"
      );
      # https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2017-02-01
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?f48db5ed"
      );
      # https://vuxml.freebsd.org/freebsd/5cfa9d0c-73d7-4642-af4f-28fbed9e9404.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?42cc67a2"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:jenkins");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:jenkins-lts");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:freebsd:freebsd");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2017/02/01");
      script_set_attribute(attribute:"patch_publication_date", value:"2017/02/01");
      script_set_attribute(attribute:"plugin_publication_date", value:"2017/02/02");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"FreeBSD Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/FreeBSD/release", "Host/FreeBSD/pkg_info");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("freebsd_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/FreeBSD/release")) audit(AUDIT_OS_NOT, "FreeBSD");
    if (!get_kb_item("Host/FreeBSD/pkg_info")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    
    if (pkg_test(save_report:TRUE, pkg:"jenkins<2.44")) flag++;
    if (pkg_test(save_report:TRUE, pkg:"jenkins-lts<2.32.2")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:pkg_report_get());
      else security_warning(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");