Vulnerabilities > CVE-2018-1999002

047910
CVSS 5.0 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
NONE
Availability impact
NONE
network
low complexity
jenkins
oracle
nessus
exploit available

Summary

A arbitrary file read vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers to send crafted HTTP requests returning the contents of any file on the Jenkins master file system that the Jenkins master has access to.

Vulnerable Configurations

Part Description Count
Application
Jenkins
1786
Application
Oracle
1

Exploit-Db

fileexploits/java/webapps/46453.py
idEDB-ID:46453
last seen2019-02-25
modified2019-02-25
platformjava
port
published2019-02-25
reporterExploit-DB
sourcehttps://www.exploit-db.com/download/46453
titleJenkins Plugin Script Security 1.49/Declarative 1.3.4/Groovy 2.60 - Remote Code Execution
typewebapps

Nessus

  • NASL familyCGI abuses
    NASL idJENKINS_2_133.NASL
    descriptionThe version of Jenkins running on the remote web server is prior to 2.133 or is a version of Jenkins LTS prior to 2.121.2. It is, therefore, affected by multiple vulnerabilities. Note that Nessus has not tested for these issues but has instead relied only on the application
    last seen2020-06-01
    modified2020-06-02
    plugin id111603
    published2018-08-09
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/111603
    titleJenkins < 2.121.2 / 2.133 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(111603);
      script_version("1.5");
      script_cvs_date("Date: 2019/11/04");
    
      script_cve_id(
        "CVE-2018-1999001",
        "CVE-2018-1999002",
        "CVE-2018-1999003",
        "CVE-2018-1999004",
        "CVE-2018-1999005",
        "CVE-2018-1999006",
        "CVE-2018-1999007"
      );
    
      script_name(english:"Jenkins < 2.121.2 / 2.133 Multiple Vulnerabilities");
      script_summary(english:"Checks the Jenkins version.");
    
      script_set_attribute(attribute:"synopsis", value:
    "A job scheduling and management system hosted on the remote web server
    is affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The version of Jenkins running on the remote web server is prior to
    2.133 or is a version of Jenkins LTS prior to 2.121.2. It is,
    therefore, affected by multiple vulnerabilities.
    
    Note that Nessus has not tested for these issues but has instead
    relied only on the application's self-reported version number.");
      script_set_attribute(attribute:"see_also", value:"https://jenkins.io/security/advisory/2018-07-18/");
      script_set_attribute(attribute:"solution", value:
    "Upgrade Jenkins to version 2.133 or later, Jenkins LTS to version
    2.121.2 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-1999002");
    
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/07/18");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/07/18");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/08/09");
    
      script_set_attribute(attribute:"plugin_type", value:"remote");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:cloudbees:jenkins");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"CGI abuses");
    
      script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("jenkins_detect.nasl");
      script_require_keys("www/Jenkins");
      script_require_ports("Services/www", 8080);
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("http.inc");
    
    port = get_http_port(default:8080);
    get_kb_item_or_exit("www/Jenkins/"+port+"/Installed");
    url = build_url(qs:'/', port:port);
    
    version = '';
    fix = '';
    if (get_kb_item("www/Jenkins/"+port+"/is_LTS") )
    {
      appname = "Jenkins Open Source LTS";
      fix = '2.121.2';
    }
    else
    {
      appname = "Jenkins Open Source";
      fix = '2.133';
    }
    
    version = get_kb_item("www/Jenkins/" + port + "/JenkinsVersion");
    if (version == 'unknown')
    {
      audit(AUDIT_UNKNOWN_WEB_APP_VER, appname, url);
    }
    
    if (ver_compare(ver:version, fix:fix, strict:FALSE) < 0)
    {
      report =
        '\n  URL           : ' + url +
        '\n  Product       : ' + appname +
        '\n  Version       : ' + version +
        '\n  Fixed version : ' + fix +
        '\n';
    
      security_report_v4(port:port, severity:SECURITY_WARNING, extra:report, xss:TRUE);
    }
    else audit(AUDIT_WEB_APP_NOT_AFFECTED, appname, url, version);
    
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_20A1881E8A9E11E8BDDFD017C2CA229D.NASL
    descriptionJenkins Security Advisory : Description(High) SECURITY-897 / CVE-2018-1999001 Users without Overall/Read permission can have Jenkins reset parts of global configuration on the next restart (High) SECURITY-914 / CVE-2018-1999002 Arbitrary file read vulnerability (Medium) SECURITY-891 / CVE-2018-1999003 Unauthorized users could cancel queued builds (Medium) SECURITY-892 / CVE-2018-1999004 Unauthorized users could initiate and abort agent launches (Medium) SECURITY-944 / CVE-2018-1999005 Stored XSS vulnerability (Medium) SECURITY-925 / CVE-2018-1999006 Unauthorized users are able to determine when a plugin was extracted from its JPI package (Medium) SECURITY-390 / CVE-2018-1999007 XSS vulnerability in Stapler debug mode
    last seen2020-06-01
    modified2020-06-02
    plugin id111176
    published2018-07-20
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/111176
    titleFreeBSD : jenkins -- multiple vulnerabilities (20a1881e-8a9e-11e8-bddf-d017c2ca229d)

Packetstorm

data sourcehttps://packetstormsecurity.com/files/download/151823/jenkins-preauth-rce-exploit.py.txt
idPACKETSTORM:151823
last seen2019-02-26
published2019-02-25
reporterwetw0rk
sourcehttps://packetstormsecurity.com/files/151823/Jenkins-Script-Security-1.49-Declarative-1.3.4-Groovy-2.60-Remote-Code-Execution.html
titleJenkins Script Security 1.49 / Declarative 1.3.4 / Groovy 2.60 Remote Code Execution

Seebug

bulletinFamilyexploit
description### SECURITY-914 / CVE-2018-1999002 An arbitrary file read vulnerability in the Stapler web framework used by Jenkins allowed unauthenticated users to send crafted HTTP requests returning the contents of any file on the Jenkins master file system that the Jenkins master process has access to. Input validation in Stapler has been improved to prevent this. ### 漏洞影响版本: * Jenkins weekly up to and including 2.132 * Jenkins LTS up to and including 2.121.1 ### 漏洞复现 测试环境: win平台 通过查找commit记录可知需要将其检出至 29ca81dd59c255ad633f1bd86cf1be40a5f02c64之前 ``` > git clone https://github.com/jenkinsci/jenkins.git > git checkout 40250f08aca7f3f8816f21870ee23463a52ef2f2 ``` 检查core/pom.xml的第41行,确保版本为1.250 ``` <staplerFork>true</staplerFork> <stapler.version>1.250</stapler.version> ``` 然后命令行下编译war包 ``` mvn clean install -pl war -am -DskipTests ``` 在jenkins\war\target目录下获得编译好的jenkins.war,同目录下启动: ``` java -jar jenkins.war ``` 在管理员登陆(有cookie)的情况下 ![](https://images.seebug.org/1532571467608) 在没有登陆(未授权,cookie清空)的情况下,只有当管理员开启了allow anonymous read access的时候,才能实现任意文件读取,否则仍需登陆。 开启: ![](https://images.seebug.org/1532571485740) 未开启: ![](https://images.seebug.org/1532571500863) 而在linux下利用条件会更加苛刻,见后文。 漏洞分析 以payload为例,请求的url为/plugin/credentials/.ini。而在hudson/Plugin.java:227 ``` /** * This method serves static resources in the plugin under <tt>hudson/plugin/SHORTNAME</tt>. **/ public void doDynamic(StaplerRequest req, StaplerResponse rsp) throws IOException, ServletException { String path = req.getRestOfPath(); String pathUC = path.toUpperCase(Locale.ENGLISH); if (path.isEmpty() || path.contains("..") || path.startsWith(".") || path.contains("%") || pathUC.contains("META-INF") || pathUC.contains("WEB-INF")) { LOGGER.warning("rejecting possibly malicious " + req.getRequestURIWithQueryString()); rsp.sendError(HttpServletResponse.SC_BAD_REQUEST); return; } // Stapler routes requests like the "/static/.../foo/bar/zot" to be treated like "/foo/bar/zot" // and this is used to serve long expiration header, by using Jenkins.VERSION_HASH as "..." // to create unique URLs. Recognize that and set a long expiration header. String requestPath = req.getRequestURI().substring(req.getContextPath().length()); boolean staticLink = requestPath.startsWith("/static/"); long expires = staticLink ? TimeUnit2.DAYS.toMillis(365) : -1; // use serveLocalizedFile to support automatic locale selection rsp.serveLocalizedFile(req, new URL(wrapper.baseResourceURL, '.' + path), expires); } ``` doDynamic函数用于处理类似/plugin/xx的请求,serveLocalizedFile在stapler-1.250-sources.jar!/org/kohsuke/stapler/ResponseImpl.java第209行左右: ``` public void serveLocalizedFile(StaplerRequest request, URL res, long expiration) throws ServletException, IOException { if(!stapler.serveStaticResource(request, this, stapler.selectResourceByLocale(res,request.getLocale()), expiration)) sendError(SC_NOT_FOUND); } ``` 先看最里面的request.getLocale(),然后再来分析stapler.selectResourceByLocale()。 跟入request.getLocale(),至jetty-server-9.2.15.v20160210-sources.jar!/org/eclipse/jetty/server/Request.java:692: ``` @Override public Locale getLocale() { ... if (size > 0) { String language = (String)acceptLanguage.get(0); language = HttpFields.valueParameters(language,null); String country = ""; int dash = language.indexOf('-'); if (dash > -1) { country = language.substring(dash + 1).trim(); language = language.substring(0,dash).trim(); } return new Locale(language,country); } return Locale.getDefault(); } ``` 这里用于处理HTTP请求中的Accept-Language头部。比如zh-cn,则会根据-的位置被分为两部分,language为zh,country为cn,然后返回Locale(language,country)对象。倘若不存在-,则country为空,language即对应我们的payload:`../../../../../../../../../../../../windows/win`,则此时返回一个Locale(language,"") 返回后即进入selectResourceByLocale(URL url, Locale locale),这里的locale参数即上一步返回的locale对象。 ``` OpenConnection selectResourceByLocale(URL url, Locale locale) throws IOException { // hopefully HotSpot would be able to inline all the virtual calls in here return urlLocaleSelector.open(url.toString(),locale,url); } ``` urlLocaleSelector对象的声明见stapler-1.250-sources.jar!/org/kohsuke/stapler/Stapler.java:390: ``` private final LocaleDrivenResourceSelector urlLocaleSelector = new LocaleDrivenResourceSelector() { @Override URL map(String url) throws IOException { return new URL(url); } }; 在stapler-1.250-sources.jar!/org/kohsuke/stapler/Stapler.java:324实现了LocaleDrivenResourceSelector类的open方法: private abstract class LocaleDrivenResourceSelector { /** * The 'path' is divided into the base part and the extension, and the locale-specific * suffix is inserted to the base portion. {@link #map(String)} is used to convert * the combined path into {@link URL}, until we find one that works. * * <p> * The syntax of the locale specific resource is the same as property file localization. * So Japanese resource for <tt>foo.html</tt> would be named <tt>foo_ja.html</tt>. * * @param path * path/URL-like string that represents the path of the base resource, * say "foo/bar/index.html" or "file:///a/b/c/d/efg.png" * @param locale * The preferred locale * @param fallback * The {@link URL} representation of the {@code path} parameter * Used as a fallback. */ OpenConnection open(String path, Locale locale, URL fallback) throws IOException { String s = path; int idx = s.lastIndexOf('.'); if(idx<0) // no file extension, so no locale switch available return openURL(fallback); String base = s.substring(0,idx); String ext = s.substring(idx); if(ext.indexOf('/')>=0) // the '.' we found was not an extension separator return openURL(fallback); OpenConnection con; // try locale specific resources first. con = openURL(map(base + '_' + locale.getLanguage() + '_' + locale.getCountry() + '_' + locale.getVariant() + ext)); if(con!=null) return con; con = openURL(map(base+'_'+ locale.getLanguage()+'_'+ locale.getCountry()+ext)); if(con!=null) return con; con = openURL(map(base+'_'+ locale.getLanguage()+ext)); if(con!=null) return con; // default return openURL(fallback); } /** * Maps the 'path' into {@link URL}. */ abstract URL map(String path) throws IOException; } ``` 先看看开头的注释,这段代码本意是想根据对应的语言(Accept-Language)来返回不同的文件,比如在ja的条件下请求foo.html,则相当于去请求foo_ja.html,这个过程会先把foo.html分成两部分:文件名foo和扩展名.html,然后根据具体的语言/国家来组合成最终的文件名。 结合payload来看,我们请求的url为/plugin/credentials/.ini,则base为空,扩展名(ext变量)即为.ini,然后通过一系列的尝试openURL,在此例中即最后一个情形con = openURL(map(base+'_'+ locale.getLanguage()+ext));,会去请求_../../../../../../../../../../../../windows/win.ini ,尽管目录_..并不存在,但在win下可以直接通过路径穿越来绕过。但在linux,则需要一个带有_的目录来想办法绕过。 ### 补丁分析 Jenkins官方修改了pom.xml,同时增加一个测试用例文件。真正的补丁在stapler这个web框架中,见commit记录: https://github.com/stapler/stapler/commit/8e9679b08c36a2f0cf2a81855d5e04e2ed2ac2b3 : ![](https://images.seebug.org/1532571563606) 对从locale取出的language,country,variant均做了正则的校验,只允许字母数字以及特定格式的出现。在接下来的openUrl中,根据三种变量的不同检查情况来调用不同的请求,从而防止了路径穿越漏洞造成的任意文件读取漏洞。
idSSV:97431
last seen2018-07-31
modified2018-07-26
published2018-07-26
reporterMy Seebug
titleJenkins 任意文件读取漏洞(CVE-2018-1999002)