CVE-2018-1000143: Jenkins GitHub Pull Request Builder Plugin - Plain Text Webhook Secret Storage
Summary
CVE-2018-1000143: Jenkins GitHub Pull Request Builder Plugin. Affects org.jenkins-ci.plugins:ghprb versions < 1.32.1. Fixed in 1.32.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Jenkins GitHub Pull Request Builder Plugin is a plugin for Jenkins, an open-source automation server. It allows Jenkins to integrate with GitHub and build pull requests automatically. The plugin enables developers to trigger Jenkins jobs based on pull request events and provides various features for managing pull requests. However, the plugin had a vulnerability that resulted in the plain text storage of the webhook secret shared between Jenkins and GitHub.
Vulnerability Detail
The GitHub Pull Request Builder Plugin stored the webhook secret in plain text, making it accessible to users with local file system access to the Jenkins controller and Jenkins administrators. This vulnerability could lead to the exposure of passwords through browser extensions, cross-site scripting vulnerabilities, and similar situations. The vulnerability was assigned the CVE identifier CVE-2018-1000143. The severity of this vulnerability is rated as LOW with a CVSS score of 3.1. The vulnerability was discovered on May 14, 2022, and the fix was implemented in version 1.32.1 of the plugin. The CWE ID associated with this vulnerability is CWE-200.
How To Fix
Minimum fixed version
1.32.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to update the plugin to the fixed version.
Conclusion
The Jenkins GitHub Pull Request Builder Plugin had a vulnerability that allowed the plain text storage of the webhook secret shared between Jenkins and GitHub. This could lead to the exposure of passwords and compromise the security of the Jenkins-GitHub integration. Users should update their plugin to version 1.32.1 or newer to fix this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:ghprb →
FAQ
The vulnerability allows unauthorized access to the webhook secret, potentially exposing passwords and compromising the security of the Jenkins-GitHub integration.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins instance is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
There are no known public exploits for this vulnerability at the time of this report. However, it is important to update the plugin to the fixed version to mitigate any potential risks.
No, this vulnerability requires local file system access to the Jenkins controller or administrative access to Jenkins. It cannot be exploited remotely.
In addition to updating the plugin, it is always recommended to follow best practices for securing Jenkins instances, such as regularly applying security updates, restricting access to the Jenkins controller, and using strong passwords.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:ghprb.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
