Permalink
Cannot retrieve contributors at this time
Name already in use
A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?
VulnerabilityDisclosure/CloudBees Jenkins Operations Center Password Disclosure
Go to fileThis commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
72 lines (49 sloc)
2.36 KB
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| cloudbees | |
| [+] Credits: Joshua Platz aka Binary1985 | |
| [+] CVE ID: CVE-2019-11350 | |
| [+] Website: https://github.com/binary1985 | |
| [+] Source: https://github.com/binary1985/VulnerabilityDisclosure/blob/master/CloudBees%20Jenkins%20Operations%20Center%20Password%20Disclosure | |
| Vendor: | |
| ========================== | |
| https://www.cloudbees.com | |
| Product: | |
| =========== | |
| CloudBees Jenkins Operations Center | |
| < Version 2.150.2.3 | |
| Jenkins and CloudBees. CloudBees is home to the original architects of Jenkins. Jenkins® is the most popular open source automation server, with more than 165,000 active sites, globally, and over 1,650,000 users. It was initially developed by Kohsuke Kawaguchi in 2004. | |
| Vulnerability Type: | |
| ========================== | |
| Cleartext Password Storage | |
| Password Retrieval | |
| Vulnerability Details: | |
| ===================== | |
| Jenkins CloudBees stores Passwords unencrypted for maintaining | |
| the proxy server configuration. These credentials can be retrieved | |
| when a trial expires when and the proxy configuration page is opened. | |
| The credentials will then be embedded directly into the HTLM in cleartext. | |
| 1) Open the Jenkins CloudBees application of an expired trial license | |
| 2) Click Request Trial License | |
| 3) View the HTLM source code, extracting the username, and password from the HTLM form. | |
| Key value name(html form ID's): | |
| proxypass(cleartext) | |
| Remediation Details: | |
| ===================== | |
| The vendor is preparing a patch. | |
| 2019-04-15 - Issue Reported to Vendor | |
| 2019-04-15 - CVE Requested | |
| 2019-04-19 - CVE-2019-11350 Issued | |
| 2019-05-06 - Vendor Confirmed Vulnerability (PRODSEC-52) | |
| 2019-07-08 - Vendor Patched Vulnerability (https://release-notes.cloudbees.com/release/21/8.18) | |
| [+] Disclaimer | |
| The information contained within this advisory is supplied "as-is" with no | |
| warranties or guarantees of fitness of use or otherwise. | |
| Permission is hereby granted for the redistribution of this advisory, | |
| provided that it is not altered except by reformatting it, and | |
| that due credit is given. Permission is explicitly given for insertion in | |
| vulnerability databases and similar, provided that due credit | |
| is given to the author. The author is not responsible for any misuse of the | |
| information contained herein and accepts no responsibility | |
| for any damage caused by the use or misuse of this information. The author | |
| prohibits any malicious use of security related information | |
| or exploits by the author or elsewhere. | |
| Binary1985 |