Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security //

Open Source

12/19/2018
09:35 AM
Larry Loeb
Larry Loeb
Larry Loeb
50%
50%

Jenkins Flaw Can Allow Attackers to Log In as Admins

New research from CyberArk finds a critical flaw in Jenkins servers that can allow an attacker to log in as an administrator, which can lead to any number of compromises and malicious activity.

Jenkins is an open source Java server tool that has found wide use in DevOps methodology, where software development is more automated to allow for testing and continuous updating and delivery.

One can set up Jenkins to automatically watch for any code changes that occur in places such as Apache Subversion (SVN) and GitHub, automatically do a code build using a tool like Maven, run static code tests, as well as utilize container technology such as Docker and Kubernetes. Further, it can take actions on production installs such as rolling back or rolling forward.

Quite the useful item when new versions of software routinely appear.

Using the "x-jenkins" search string in Shodan shows over 78,000 installations world-wide that are Internet-facing. One vendor in the Jenkins community finds there are more than 165,000 active installations and an estimated 1.65 million users around the world as of February.

Jenkins Configure Global Security page\r\n(Source: CyberArk)\r\n
Jenkins Configure Global Security page
\r\n(Source: CyberArk)\r\n

Now, however, researchers at CyberArk have found that Jenkins has had some serious problems inside of it, even though it has been around since 2005 -- albeit in different forms.

The critical problems would allow attackers to gain admin status or log in with invalid credentials, allowing them to take over the server.

CyberArk researchers first identified the problem -- CVE-2018-1999001 -- which allowed attackers to provide crafted login credentials that would cause Jenkins to move the startup configuration (config.xml) file from the Jenkins home directory.

On restart without the configuration file, it will be running in the "Security Disabled" mode. This mode requires no authentication, and considers any actor with access to the Jenkins master program an administrator.

A problem, to be sure.

How would an attacker force a restart to happen so that they may exploit this?

It can because of another bug that CyberArk found -- CVE-2018-1999043 -- which will crash the Java virtual machine. By using the Curl command with very long usernames, CyberArk showed that they able to crash the Java virtual machine due to low memory. That meant that an attacker could force the Jenkins admin to restart the Jenkins server whenever they wanted after moving the configuration file.

But wait, there's more.

Once restarted, the attacker could then copy the previously moved config.xml file back into its original place. If done at the right time and quickly enough, security configurations would be restored without any trace that there had been a time period where the security master switch was not enabled. Very stealthy and untraceable.

Of course, when security is not in an enabled state attackers can carry out their nefarious activities, including slapping a cryptominer onto it, or installing a backdoor.

Even though these two problems were corrected in recent patched Jenkins distributions, a more targeted search on Shodan shows that thousands of unpatched Jenkins versions are still out there, which are still at risk from these two vulnerabilities.

This is what is so often seen after a security problem has been patched: the patch may not get applied to vulnerable systems. Yet again, security teams need to make sure that the latest versions of a program are the ones that are in use or pay the price.

Related posts:

— Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
FluBot Malware's Rapid Spread May Soon Hit US Phones
Kelly Sheridan, Staff Editor, Dark Reading,  4/28/2021
Slideshows
7 Modern-Day Cybersecurity Realities
Steve Zurier, Contributing Writer,  4/30/2021
Commentary
How to Secure Employees' Home Wi-Fi Networks
Bert Kashyap, CEO and Co-Founder at SecureW2,  4/28/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-24259
PUBLISHED: 2021-05-05
The “Elementor Addon Elements� WordPress Plugin before 1.11.2 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
CVE-2021-24260
PUBLISHED: 2021-05-05
The “Livemesh Addons for Elementor� WordPress Plugin before 6.8 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
CVE-2021-24261
PUBLISHED: 2021-05-05
The “HT Mega – Absolute Addons for Elementor Page Builder� WordPress Plugin before 1.5.7 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by ...
CVE-2021-24262
PUBLISHED: 2021-05-05
The “WooLentor – WooCommerce Elementor Addons + Builder� WordPress Plugin before 1.8.6 has a widget that is vulnerable to stored Cross-Site Scripting (XSS) by lower-priv...
CVE-2021-24263
PUBLISHED: 2021-05-05
The “Elementor Addons – PowerPack Addons for Elementor� WordPress Plugin before 2.3.2 for WordPress has several widgets that are vulnerable to stored Cross-Site Scriptin...