CVE-2018-1000601: Jenkins SSH Credentials Plugin - Exposure of Sensitive Information
Summary
CVE-2018-1000601: Exposure of Sensitive Information to an Unauthorized Actor in Jenkins SSH Credentials Plugin. Affects org.jenkins-ci.plugins:ssh-credentials versions < 1.14. Fixed in 1.14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins SSH Credentials Plugin is a Maven package (org.jenkins-ci.plugins:ssh-credentials) that provides functionality for managing SSH credentials in Jenkins. It allows users to securely store and use SSH private keys for authentication purposes. This plugin is widely used in Jenkins installations for managing SSH credentials and enabling secure communication with remote systems.
Vulnerability Detail
The Jenkins SSH Credentials Plugin version 1.13 and earlier, specifically the BasicSSHUserPrivateKey.java file, is vulnerable to an arbitrary file read vulnerability. This vulnerability allows attackers with a Jenkins account and the permission to configure credential bindings to read arbitrary files from the Jenkins master file system. By exploiting this vulnerability, an unauthorized actor can gain access to sensitive information stored on the Jenkins server, potentially leading to further compromise of the system.
How To Fix
Minimum fixed version
1.14
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict the permissions of Jenkins accounts to limit access to sensitive files. Additionally, it is advisable to monitor the Jenkins server for any unauthorized access attempts and regularly review the access controls and permissions assigned to Jenkins accounts.
Conclusion
The Jenkins SSH Credentials Plugin version 1.13 and earlier is vulnerable to an arbitrary file read vulnerability, which can result in unauthorized access to sensitive information stored on the Jenkins server. It is crucial to upgrade to version 1.14 or later to fix this vulnerability and prevent potential compromise of the system. Restricting permissions and monitoring for unauthorized access attempts can provide temporary mitigation. For additional support and guidance, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:ssh-credentials →
FAQ
This vulnerability allows attackers with a Jenkins account and the permission to configure credential bindings to read arbitrary files from the Jenkins master file system. It can lead to unauthorized access to sensitive information stored on the Jenkins server.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins installation is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this one.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability. However, it is important to promptly apply the recommended fix to mitigate the risk of unauthorized access to sensitive information.
While upgrading to the latest version of the Jenkins SSH Credentials Plugin is the recommended solution, you can temporarily mitigate the risk by restricting the permissions of Jenkins accounts and monitoring for any unauthorized access attempts.
For further support and assistance in remediating this vulnerability, you can reach out to info@devnack.com. Our team of experts will be happy to assist you in securing your Jenkins installation.
