CVE-2020-2114: Jenkins S3 Publisher Plugin transmits credentials in plain text during configuration
Summary
CVE-2020-2114: Jenkins S3 Publisher Plugin transmits credentials in plain text during configuration. Affects org.jenkins-ci.plugins:s3 versions < 0.11.5. Fixed in 0.11.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Jenkins S3 Publisher Plugin is a plugin for the Jenkins automation server that allows users to publish artifacts to Amazon S3 buckets. It provides integration with Amazon S3 for storing and retrieving files during the build process. The plugin is commonly used in CI/CD pipelines to upload build artifacts to S3 for storage or distribution. However, versions 0.11.4 and earlier of the plugin have a vulnerability that exposes the secret key used for authentication with Amazon S3.
Vulnerability Detail
The S3 Publisher Plugin stores a secret key in its global configuration. While the credential is stored encrypted on disk, it is transmitted in plain text as part of the configuration form. This means that the secret key can be exposed through browser extensions, cross-site scripting vulnerabilities, and similar situations. An attacker who gains access to the transmitted secret key can potentially gain unauthorized access to the associated Amazon S3 bucket and perform actions on behalf of the Jenkins user. The vulnerability has a CVSS score of 3.1, indicating a low severity.
How To Fix
Minimum fixed version
0.11.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Users must upgrade to the fixed version of the S3 Publisher Plugin to address the issue.
Conclusion
The Jenkins S3 Publisher Plugin has a vulnerability that exposes the secret key used for authentication with Amazon S3. This can lead to unauthorized access to the associated S3 bucket and potential data loss or manipulation. Users should upgrade to version 0.11.5 or later of the plugin to fix the vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:s3 →
FAQ
This vulnerability allows an attacker to potentially gain unauthorized access to the Amazon S3 bucket associated with the Jenkins instance. They can perform actions on behalf of the Jenkins user, potentially leading to data loss, data manipulation, or unauthorized access to sensitive information.
You can use the Vulert playground (https://vulert.com/scanner) to check if your Jenkins instance is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just the pom.xml file.
No, there is no known workaround for this vulnerability. Users must upgrade to the fixed version of the S3 Publisher Plugin to address the issue.
The CVSS score of this vulnerability is 3.1, indicating a low severity.
You can find more information about this vulnerability in the GitHub Advisory Database (https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-ffr6-8cv5-j637/GHSA-ffr6-8cv5-j637.json).
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:s3.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
