2019 DevOps World | Jenkins World Lisbon Conference slides. The Story, The Findings And The Fixes Behind More Than A 100 Jenkins Plugins Vulnerabilities

1. The Story, The Findings And
The Fixes Behind More Than
A 100 Jenkins Plugins
Vulnerabilities
Viktor Gazdag

2. © 2019 All Rights Reserved. 2
Timeline
• Who Am I
• Goal Of The Talk
• Statistics
• The Story
• The Findings
• The Fixes
• Report Vulnerability
• Related Articles
• Q&A

3. © 2019 All Rights Reserved. 3
Who Am I
• Security Consultant at NCC Group
• IT Helpdesk, System Administrator, System Engineer
• Ethical Hacking Specialist, Security Consultant
• 2019 Jenkins Security MVP
• CRT, OSCP, eWPT, eWPTX, eMAPT
• MCSE 2012, NS0-155
• Travel, Video Games, Security Research

4. © 2019 All Rights Reserved. 4
Thank You
• Jenkins / CloudBees - Daniel Beck
• NCC Group - Matt Lewis, Mario Iregui, Bernardo Damele, Jennifer Fernick,
Simon Harraghy, Balazs Bucsay
• Irene Michlin, Soroush Dalili

5. © 2019 All Rights Reserved. 5
Goal Of The Talk
• Why – Give Back To The Community, Raise Awareness
• How – Show The Problems And Fixes
• What – Presentation, Blog, Advisories, White Paper*, Tool*

6. © 2019 All Rights Reserved. 6
Core and Plugin Vulnerabilities By Years
• Core And Plugins
• SECURITY-* And CVE-*
0
50
100
150
200
250
300
350
2010 2011 2012 2013 2014 2015 2016 2017 2018 2019
Vulnerabilities and Advisories By Year
Vulnerability Advisory

7. © 2019 All Rights Reserved. 7
The Story
• Started With A Project
• Continued With A Jenkins Advisory
• Triggered By A Second Advisory

8. © 2019 All Rights Reserved. 8
The Findings
• Credentials Stored In Plain Text, CSRF, SSRF, XSS,
TLS Certificate Validation Disabled, Missing
Permission Check
• 15 Advisories, 128 Jenkins Plugin Vulnerabilities and
1 Core Vulnerability, 118 CVEs, 1 CVE Pending, 10
Issues Without CVEs

9. © 2019 All Rights Reserved. 9
Distribution Of The Vulnerability Types
Submitted And Released Findings (2017.11 – 2019.10)
0
10
20
30
40
50
60
70
80
Credentials stored plain
text
CSRF Missing permission check SSRF with permission
check
CSRF with permission
check
TLS certificate validation
disabled
XSS
Core and Plugin Vulnerabilities

10. © 2019 All Rights Reserved. 10
Findings - Tools
• Black Box Test
• Burp Suite Pro
• Linux
• netcat, cat, less, ls, openssl, python,
vi
• Simple Python program with Self-
Signed SSL Certificate
• Browser
• Looked For Specific Issues

11. © 2019 All Rights Reserved. 11
The Findings
• Credentials Stored In Plain Text

12. © 2019 All Rights Reserved. 12
The Findings
• Credentials Stored In Plain Text
• Web Form

13. © 2019 All Rights Reserved. 13
The Findings
• Credentials Stored In Plain Text

14. © 2019 All Rights Reserved. 14
The Findings
• Credentials Stored In Plain Text
• Multiple Path
• /var/lib/Jenkins/*.xml

15. © 2019 All Rights Reserved. 15
The Findings
• Credentials Stored In Plain Text

16. © 2019 All Rights Reserved. 16
The Findings
• Credentials Stored In Plain Text
• Multiple Path
• /var/lib/Jenkins/job/TestJob/con
fig.xml

17. © 2019 All Rights Reserved. 17
The Findings
• Missing Permission Check

18. © 2019 All Rights Reserved. 18
The Findings
• Cross-Site Request Forgery
(CSRF) And Missing Permission
Check Allowed Capturing
Credentials
• “CSRF is an attack that forces
an end user to execute
unwanted actions on a web
application in which they're
currently authenticated.” -
OWASP

19. © 2019 All Rights Reserved. 19
The Findings
• CSRF And Missing Permission Check
Allowed Capturing Credentials

20. © 2019 All Rights Reserved. 20
The Findings
• CSRF And Missing Permission Check Allowed Capturing Credentials

21. © 2019 All Rights Reserved. 21
The Findings
• CSRF And Missing Permission
Check Allowed Capturing
Credentials

22. © 2019 All Rights Reserved. 22
The Findings
• CSRF And Missing Permission Check
Allowed Capturing Credentials

23. © 2019 All Rights Reserved. 23
The Findings
• CSRF And Missing Permission
Check Lead to Server-Side
Request Forgery (SSRF)
• “In a SSRF attack the attacker
can change a parameter used
on the web application to
create or control requests from
the vulnerable server.” -
Netsparker

24. © 2019 All Rights Reserved. 24
The Findings
• CSRF And Missing Permission
Check Lead to SSRF

25. © 2019 All Rights Reserved. 25
The Findings
• Cross-Site Scripting (XSS)
• Reflected, Stored, DOM
• “XSS attacks are a type of injection, in which malicious scripts are injected into
otherwise benign and trusted websites.” - OWASP

26. © 2019 All Rights Reserved. 26
The Findings
• XSS

27. © 2019 All Rights Reserved. 27
The Findings
• XSS

28. © 2019 All Rights Reserved. 28
The Fixes
• Credentials Stored In Plain Text

29. © 2019 All Rights Reserved. 29
The Fixes
• Credentials Stored In Plain Text
• Using a Secret Type Offered By Jenkins
• 3rd Party Plugin Called Credentials Plugin

30. © 2019 All Rights Reserved. 30
The Fixes
• Credentials Stored In Plain Text

31. © 2019 All Rights Reserved. 31
The Fixes
• Credentials Stored In Plain Text

32. © 2019 All Rights Reserved. 32
The Fixes
• Credentials Stored In Plain Text

33. © 2019 All Rights Reserved. 33
The Fixes
• CSRF

34. © 2019 All Rights Reserved. 34
The Fixes
• CSRF

35. © 2019 All Rights Reserved. 35
The Fixes
• CSRF

36. © 2019 All Rights Reserved. 36
The Fixes
• CSRF

37. © 2019 All Rights Reserved. 37
The Fixes
• Missing Permission Check

38. © 2019 All Rights Reserved. 38
The Fixes
• XSS

39. © 2019 All Rights Reserved. 39
The Fixes
• XSS

40. © 2019 All Rights Reserved. 40
Report Vulnerability
• Where To Report:
• Jenkins: https://jenkins.io/security/
• CloudBees: https://www.cloudbees.com/security-policy
• Jenkins JIRA: https://issues.jenkins-ci.org/browse/SECURITY
• Include The Following:
• Check Previous Issues: https://jenkins.io/security/advisories/
• Core And Plugin Version
• Description
• Reproduction Steps
• Proof Of Concept (Screenshots, Console Outputs etc.)
• Deadline (Optional)

41. © 2019 All Rights Reserved. 41
Related Articles
• Storing Secret:
• On Disk And Configuration Forms: https://jenkins.io/doc/developer/security/secrets/
• CSRF:
• Form Validation And CSRF: https://jenkins.io/doc/developer/security/form-validation/
• XSS:
• XSS Prevention: https://jenkins.io/doc/developer/security/xss-prevention/
• Other:
• Blog Post: https://www.nccgroup.trust/uk/about-us/newsroom-and-
events/blogs/2019/may/story-of-a-hundred-vulnerable-jenkins-plugins/
• Teaser Blog Post: https://jenkins.io/blog/2019/11/29/do-plugins-store-credentials-in-a-
secure-way/
• Technical Advisory: https://www.nccgroup.trust/uk/our-research/jenkins-plugins-and-core-
technical-summary-advisory/?research=Technical+advisories

42. © 2019 All Rights Reserved. 42
Questions
Feel Free To Ask Personally
Email viktor.gazdag@nccgroup.com

43. Thank You