CVE-2018-1000196: Jenkins Gitlab Hook Plugin - GitLab API Token Exposure
Summary
CVE-2018-1000196: Jenkins Gitlab Hook Plugin stores and displays GitLab API token in plain text. Affects org.jenkins-ci.ruby-plugins:gitlab-hook versions < 1.4.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Gitlab Hook Plugin is a Maven package (org.jenkins-ci.ruby-plugins:gitlab-hook) that provides integration between Jenkins and GitLab. It allows Jenkins to receive notifications from GitLab when certain events occur, such as code pushes or merge requests. The plugin stores and displays the GitLab API token, which is used for authentication, in plain text. This vulnerability affects versions 1.4.2 and older of the plugin.
Vulnerability Detail
The vulnerability in the Jenkins Gitlab Hook Plugin allows attackers with local Jenkins master file system access or control of a Jenkins administrator's web browser to retrieve the configured GitLab token. This token can be used to perform unauthorized actions on the GitLab server, potentially leading to data breaches, code tampering, or other malicious activities. The sensitive information is exposed in the gitlab_notifier.rb and views/gitlab_notifier/global.erb files.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, it is advised to manually remove or obfuscate the GitLab API token from the affected files. This can be done by editing the gitlab_notifier.rb and views/gitlab_notifier/global.erb files and replacing the token with a placeholder value or removing it entirely. However, this workaround is not recommended as it does not address the root cause of the vulnerability and may introduce other security risks.
Conclusion
The Jenkins Gitlab Hook Plugin is vulnerable to an exposure of sensitive information issue, where the GitLab API token is stored and displayed in plain text. This can be exploited by attackers with access to the Jenkins master file system or control of a Jenkins administrator's web browser. To mitigate this vulnerability, it is crucial to upgrade to a non-affected version of the plugin and ensure that the token is securely stored and encrypted. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for org.jenkins-ci.ruby-plugins:gitlab-hook →
FAQ
The vulnerability allows attackers with access to the Jenkins master file system or control of a Jenkins administrator's web browser to retrieve the GitLab API token. This token can be used to perform unauthorized actions on the GitLab server, potentially leading to data breaches, code tampering, or other malicious activities.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins instance is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this one.
Yes, it is recommended to upgrade to a version of the Jenkins Gitlab Hook Plugin that is not affected by this vulnerability. The latest version should have implemented the necessary security fixes to protect the GitLab API token.
While it is not recommended, you can manually remove or obfuscate the GitLab API token from the affected files as a temporary workaround. However, this does not address the root cause of the vulnerability and may introduce other security risks.
You can find more information about this vulnerability in the Jenkins Gitlab Hook Plugin advisory on the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-7p4p-v6hr-gp3m/GHSA-7p4p-v6hr-gp3m.json
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.ruby-plugins:gitlab-hook.
