CVE-2021-21625: Missing permission checks in Jenkins CloudBees AWS Credentials Plugin allows enumerating credentials IDs
Summary
CVE-2021-21625: CloudBees AWS Credentials Plugin 1.28 and earlier does not perform a permission check in a helper method for HTTP endpoints. Affects org.jenkins-ci.plugins:aws-credentials versions < 1.28.1. Fixed in 1.28.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The CloudBees AWS Credentials Plugin is a plugin for the Jenkins automation server that allows users to store and manage AWS credentials within Jenkins. It provides a convenient way to securely access AWS services from Jenkins jobs. The plugin integrates with various AWS-related plugins, such as Amazon Elastic Container Service (ECS) / Fargate, AWS Parameter Store Build Wrapper, and AWS SAM. These plugins rely on the CloudBees AWS Credentials Plugin to manage and retrieve AWS credentials stored in Jenkins.
Vulnerability Detail
The CloudBees AWS Credentials Plugin version 1.28 and earlier has a vulnerability that allows attackers with Overall/Read permission to enumerate credentials IDs of AWS credentials stored in Jenkins. This vulnerability arises due to missing permission checks in a helper method for HTTP endpoints. If any of the affected plugins are installed, an attacker can exploit this vulnerability to obtain the credentials IDs. These credentials IDs can then be used as part of an attack to capture the credentials using another vulnerability. The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
How To Fix
Minimum fixed version
1.28.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the CloudBees AWS Credentials Plugin to the fixed version.
Conclusion
The CloudBees AWS Credentials Plugin version 1.28 and earlier is vulnerable to an enumeration vulnerability that allows attackers to obtain AWS credentials IDs. To mitigate this vulnerability, it is recommended to update the plugin to version 1.28.1 or later. This update includes permission checks in the helper method for HTTP endpoints, preventing unauthorized enumeration of credentials IDs. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:aws-credentials →
FAQ
This vulnerability allows attackers with Overall/Read permission to enumerate credentials IDs of AWS credentials stored in Jenkins. While the vulnerability itself does not directly expose the credentials, the obtained credentials IDs can be used in conjunction with another vulnerability to capture the credentials.
Versions 1.28 and earlier of the CloudBees AWS Credentials Plugin are affected by this vulnerability.
There are no known public exploits for this vulnerability at the time of this report. However, it is crucial to update the plugin to the fixed version to mitigate the risk.
Yes, this vulnerability can be exploited remotely by attackers with Overall/Read permission in Jenkins.
Yes, this vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:aws-credentials.
