Build-Publisher Plugin up to 1.21 on Jenkins hudson.plugins.build_publisher.BuildPublisher.xml credentials management

Summaryinfo

A vulnerability categorized as critical has been discovered in Build-Publisher Plugin up to 1.21 on Jenkins. This vulnerability affects unknown code of the file hudson.plugins.build_publisher.BuildPublisher.xml. Executing a manipulation can lead to credentials management. This vulnerability is handled as CVE-2017-1000387. It is possible to launch the attack on the local host. There is not any exploit available.

Detailsinfo

A vulnerability classified as critical was found in Build-Publisher Plugin up to 1.21 on Jenkins (Jenkins Plugin). This vulnerability affects an unknown functionality of the file hudson.plugins.build_publisher.BuildPublisher.xml. The manipulation with an unknown input leads to a credentials management vulnerability. The CWE definition for the vulnerability is CWE-255. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Jenkins Build-Publisher plugin version 1.21 and earlier stores credentials to other Jenkins instances in the file hudson.plugins.build_publisher.BuildPublisher.xml in the Jenkins master home directory. These credentials were stored unencrypted, allowing anyone with local file system access to access them. Additionally, the credentials were also transmitted in plain text as part of the configuration form. This could result in exposure of the credentials through browser extensions, cross-site scripting vulnerabilities, and similar situations.

The bug was discovered 10/23/2017. The weakness was released 01/26/2018 with Cisco (Website). The advisory is shared for download at jenkins.io. This vulnerability was named CVE-2017-1000387 since 11/29/2017. The attack needs to be approached locally. The successful exploitation needs a single authentication. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1552.

The vulnerability was handled as a non-public zero-day exploit for at least 94 days. During that time the estimated underground price was around $0-$5k. By approaching the search of inurl:hudson.plugins.build_publisher.BuildPublisher.xml it is possible to find vulnerable targets with Google Hacking.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 101544†). Entries connected to this vulnerability are available at VDB-112455, VDB-112457, VDB-112458 and VDB-112459. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Jenkins Plugin

Name

• Build-Publisher Plugin

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion