forked from binary1985/VulnerabilityDisclosure
-
Notifications
You must be signed in to change notification settings - Fork 0
/
CloudBees Jenkins Operations Center Password Disclosure
70 lines (47 loc) · 2.26 KB
/
CloudBees Jenkins Operations Center Password Disclosure
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
[+] Credits: Joshua Platz aka Binary1985
[+] CVE ID: CVE-2019-11350
[+] Website: https://github.com/binary1985
[+] Source: https://github.com/binary1985/VulnerabilityDisclosure/edit/master/CloudBees%20Jenkins%20Operations%20Center%20Password%20Disclosure
Vendor:
==========================
https://www.cloudbees.com
Product:
===========
CloudBees Jenkins Operations Center
< Version 2.150.2.3
Jenkins and CloudBees. CloudBees is home to the original architects of Jenkins. Jenkins® is the most popular open source automation server, with more than 165,000 active sites, globally, and over 1,650,000 users. It was initially developed by Kohsuke Kawaguchi in 2004.
Vulnerability Type:
==========================
Cleartext Password Storage
Password Retrieval
Vulnerability Details:
=====================
Jenkins CloudBees stores Passwords unencrypted for maintaining
the proxy server configuration. These credentials can be retrieved
when a trial expires when and the proxy configuration page is opened.
The credentials will then be embedded directly into the HTLM in cleartext.
1) Open the Jenkins CloudBees application of an expired trial license
2) Click Request Trial License
3) View the HTLM source code, extracting the username, and password from the HTLM form.
Key value name(html form ID's):
proxypass(cleartext)
Remediation Details:
=====================
The vendor is preparing a patch.
2019-04-15 - CVE Requested
2019-04-19 - CVE-2019-11350 Issued
2019-05-05 - Issue Reported to Vendor
2019-05-06 - Vendor Confirmed Vulnerability (PRODSEC-52)
[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no
warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory,
provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in
vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the
information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author
prohibits any malicious use of security related information
or exploits by the author or elsewhere.
Binary1985