CVE-2017-1000387: Jenkins Build-Publisher Plugin Insufficiently Protected Credentials
Summary
CVE-2017-1000387: Jenkins Build-Publisher plugin has Insufficiently Protected Credentials. Affects org.jenkins-ci.plugins:build-publisher versions < 1.22. Fixed in 1.22. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Build-Publisher plugin is a component of the Jenkins automation server that allows users to publish build artifacts to other Jenkins instances. It facilitates the seamless transfer of files and data between different Jenkins environments. The plugin is an integral part of the Jenkins ecosystem and is commonly used by developers and administrators to streamline their build and deployment processes.
Vulnerability Detail
The Jenkins Build-Publisher plugin, specifically versions 1.21 and earlier, suffers from a vulnerability that exposes credentials to other Jenkins instances. These credentials are stored unencrypted in the file 'hudson.plugins.build_publisher.BuildPublisher.xml' within the Jenkins master home directory. This means that anyone with local file system access can potentially access these credentials. Additionally, the credentials are transmitted in plain text as part of the configuration form, making them susceptible to exposure through browser extensions, cross-site scripting vulnerabilities, and similar situations. The consequences of this vulnerability include unauthorized access to sensitive information, potential data breaches, and compromised Jenkins instances. However, the Build-Publisher Plugin version 1.22 addresses this issue by encrypting the credentials on disk and only transmitting their encrypted form to users viewing the configuration form.
How To Fix
Minimum fixed version
1.22
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, users can consider implementing additional security measures such as restricting file system access to the Jenkins master home directory, employing browser security extensions, and regularly monitoring for any suspicious activity or unauthorized access attempts.
Conclusion
The Jenkins Build-Publisher plugin version 1.21 and earlier suffer from a vulnerability that exposes credentials to other Jenkins instances. This can lead to unauthorized access, data breaches, and compromised Jenkins environments. To mitigate this risk, it is crucial to upgrade to version 1.22 or later, which encrypts the credentials and transmits them securely. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:build-publisher →
FAQ
The Jenkins Build-Publisher plugin is a component of the Jenkins automation server that enables users to publish build artifacts to other Jenkins instances. It simplifies the process of transferring files and data between different Jenkins environments.
This vulnerability exposes credentials to other Jenkins instances, potentially leading to unauthorized access, data breaches, and compromised Jenkins environments.
To fix this vulnerability, it is recommended to upgrade the Jenkins Build-Publisher plugin to version 1.22 or later, which encrypts the stored credentials and transmits them in an encrypted form during configuration.
While there are no specific workarounds provided, users can enhance security by restricting file system access, using browser security extensions, and monitoring for suspicious activity.
There may be alternative plugins available that provide similar functionality. It is advisable to explore other options and evaluate their security features before making a switch.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:build-publisher.
