En más acosado de plugins de Jenkins se descubren vulnerabilidades

Gran cantidad de plugins para instrumento abierto de la integración ininterrumpida de software Jenkins contienen diferentes errores y vulnerabilidades.

Vulnerabilities mainly connected with storing of passwords in non-encrypted form. Adicionalmente, en suaves CSRF-bugs encontrados Jenkins’ que permiten steaking credenciales y cometen ataques CSRF-.

Viktor Rich, specialist of NCC Group that tested great number of Jenkins’ plugins, puesto de manifiesto estos problemas.

These tests resulted in more than 100 plugins found vulnerable and several coordinated and responsible public disclosures”, — reports researcher.

As expert explained, though Jenkins encrypts passwords in credentials.xml file, some developers use other methods of data storage. In the majority of cases these decisions do not suggest are encryption. Además, some web-forms, where users input credentials, enable leakage of passwords or secret tokens.

Web form shows no sign of clear text password
Web form shows no sign of clear text password

CSRF-vulnerabilities are connected with plugins’ functions, with the use of which users can check credentials and connect to a server. They mostly exist, as developers do not apply POST-requests that prevent attacks with the use of CSRF token.

In the last two years, Jenkins developers released several notifications that describe vulnerabilities in different plugins, including series of bugs, discovered by Gazdag.

Vulnerable plugins interact with a wide circle of services, incluso Gorjeo, AWS, VMware y Azur. In most cases software was created by side developers that is not connected to vendor, whose software exploits plugin.

Como se ha señalado, authors of several plugins have already fixed bugs in their software, though many are still vulnerable. In their turn, Jenkins developers published a vast list of plugins that still are not fixed.

Jenkins — is an open source tool supporting building, deploying and automating software development and delivery, and can be extended by plugins to introduce additional functionalities like Active Directory authentication, or solve reoccurring tasks such as executing a static code analyser or copying a compiled software to a CIFS share. Similar to WordPress, the core framework is extended by hundreds of plugins; where most of these plugins are developed by 3rd party developers and it is up to them how securely they write them.

Fuente: https://www.nccgroup.trust

Acerca de Trojan Killer

Trojan Killer llevar portátil en su dispositivo de memoria. Asegúrese de que usted es capaz de ayudar a su PC resistir cualquier amenaza cibernética donde quiera que vaya.

también puedes ver

MageCart en la plataforma de nube Heroku

Los investigadores encontraron Varios MageCart Web skimmers En Heroku Cloud Platform

Investigadores de Malwarebytes informaron sobre la búsqueda de varios skimmers MageCart web en la plataforma de nube Heroku …

Android Spyware CallerSpy

máscaras spyware CallerSpy como una aplicación de chat Android

expertos de Trend Micro descubrieron que el malware CallerSpy, que enmascara como una aplicación de chat y Android, …

Deja una respuesta