Listen to this Post
This vulnerability exists in Jenkins’ handling of the build authorization token (AuthToken), a feature allowing remote triggering of builds via a URL. When a job is configured with the “Trigger builds remotely” option, Jenkins generates a token. In affected versions, this token is stored as plaintext within the job’s `config.xml` file on the controller’s disk. Any user or process with “Item/Extended Read” permission for the job can retrieve this token via the Jenkins API (e.g., /job/[job-name]/config.xml). Furthermore, any actor with read access to the Jenkins controller’s file system (e.g., through compromised backups, host access, or shared storage) can directly read the `config.xml` files from the `JENKINS_HOME/jobs/` directory. This exposes the authentication secret, allowing unauthorized parties to trigger builds remotely without proper permissions, potentially leading to unauthorized code execution, denial of service, or data exfiltration depending on the nature of the build jobs.
Platform: Jenkins
Version: >=2.529 <2.541, <2.528.3
Vulnerability: Plaintext token storage
Severity: Moderate
Date: 2024-12-10
Prediction: Patched 2024-12-10
What Undercode Say:
Analytics:
Locate config.xml files containing plaintext auth tokens find $JENKINS_HOME/jobs -name "config.xml" -type f | xargs grep -l "authToken" Extract the token value from a specific job's config curl -s -u "USER:API_TOKEN" "https://jenkins-host/job/myjob/config.xml" | grep -oP '(?<=<authToken>)[^<]+'
How Exploit:
- Attacker gains Item/Extended Read permission or filesystem access.
- Attacker extracts plaintext `authToken` from `config.xml` via API or direct file read.
- Attacker triggers remote build using token: `curl -X POST “https://jenkins-host/job/myjob/build?token=EXPOSED_TOKEN”`
Protection from this CVE:
- Upgrade to Jenkins 2.541, 2.528.3 (LTS).
- Review user Item/Extended Read permissions.
- Secure Jenkins controller filesystem access.
- Consider disabling remote build trigger feature.
Impact:
- Unauthorized build triggering.
- Potential credential chain attacks.
- Information disclosure.
- Denial of service.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
