Große Anzahl von Plug-in für offenes Instrument ununterbrochener Integration von Jenkins Software enthält verschiedene Bugs und Schwachstellen.
Vulnerabilities mainly connected with storing of passwords in non-encrypted form. zusätzlich, in Jenkins’ soft gefunden CSRF-Fehler, die Berechtigungsnachweise und begehen CSRF-Angriffe ermöglichen steaken.Viktor Reiche, specialist of NCC Group that tested great number of Jenkins’ plugins, ergab diese Probleme.
“These tests resulted in more than 100 plugins found vulnerable and several coordinated and responsible public disclosures”, — reports researcher.
As expert explained, though Jenkins encrypts passwords in credentials.xml file, some developers use other methods of data storage. In the majority of cases these decisions do not suggest are encryption. Außerdem, some web-forms, where users input credentials, enable leakage of passwords or secret tokens.
CSRF-vulnerabilities are connected with plugins’ functions, with the use of which users can check credentials and connect to a server. They mostly exist, as developers do not apply POST-requests that prevent attacks with the use of CSRF token.
In the last two years, Jenkins developers released several notifications that describe vulnerabilities in different plugins, including series of bugs, discovered by Gazdag.
Vulnerable plugins interact with a wide circle of services, einschließlich zwitschern, AWS, VMware und Azurblau. In most cases software was created by side developers that is not connected to vendor, whose software exploits plugin.
wie bereits erwähnt, authors of several plugins have already fixed bugs in their software, though many are still vulnerable. In their turn, Jenkins developers published a vast list of plugins that still are not fixed.
Quelle: https://www.nccgroup.trust
