CVE-2018-1999027: Jenkins SaltStack Plugin Information Exposure
Summary
CVE-2018-1999027: An exposure of sensitive information vulnerability exists in Jenkins SaltStack Plugin 3.1.6 and earlier in SaltAPIBuilder.java, SaltAPIStep.java. Affects org.jenkins-ci.plugins:saltstack versions < 3.1.7. Fixed in 3.1.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins SaltStack Plugin is a plugin for the Jenkins automation server that integrates with SaltStack, a popular configuration management and remote execution tool. This plugin allows users to execute SaltStack commands as part of their Jenkins workflows. It provides functionality for connecting to a SaltStack API and executing various operations. However, a vulnerability has been discovered in versions 3.1.6 and earlier of the plugin, which could lead to the exposure of sensitive information.
Vulnerability Detail
The vulnerability in Jenkins SaltStack Plugin allows attackers to capture credentials with a known credentials ID stored in Jenkins. The issue arises from a lack of permission checks on methods implementing form validation. This allows users with Overall/Read access to Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins, and causing Jenkins to submit HTTP requests to attacker-specified URLs. Additionally, these form validation methods do not require POST requests, resulting in a CSRF vulnerability. The vulnerability has a CVSS score of 4.2, indicating a moderate severity level.
How To Fix
Minimum fixed version
3.1.7
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, a temporary workaround is to restrict access to the Jenkins instance and ensure that only trusted users have Overall/Administer permissions. This can help mitigate the risk of unauthorized access and exploitation of the vulnerability.
Conclusion
The Jenkins SaltStack Plugin vulnerability (CVE-2018-1999027) exposes sensitive information and allows unauthorized access to Jenkins instances. It is crucial to upgrade to version 3.1.7 or later of the plugin to mitigate this vulnerability. If immediate upgrade is not possible, restricting access and ensuring trusted users have appropriate permissions can provide temporary protection. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:saltstack →
FAQ
The vulnerability allows attackers with Overall/Read access to Jenkins to capture credentials stored in Jenkins and perform unauthorized actions by submitting HTTP requests to attacker-specified URLs.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins instance is affected by this vulnerability. Simply provide the URL of your Jenkins instance, and Vulert will analyze the dependencies and alert you if any vulnerable versions are detected.
At the time of this advisory, there is no known public exploit for this vulnerability. However, it is important to apply the recommended fixes to mitigate the risk of exploitation.
While there may be alternative plugins or solutions available for integrating SaltStack with Jenkins, it is recommended to use the latest version of the Jenkins SaltStack Plugin, as it includes the necessary fixes to address this vulnerability.
You can find more information about this vulnerability, including the CVE identifier, on the Vulert website (https://vulert.com) or by contacting the Vulert support team at info@devnack.com.
