Jenkins Job Config History Plugin Secret Exposure via Historical Configs

Executive Summary

The Jenkins Job Configuration History Plugin version 1356.ve360da_6c523a_ and earlier has a vulnerability where it does not redact encrypted secret values when displaying historical job and agent configurations.

This means that attackers who have Extended Read permission can view these encrypted secret values in the configuration history, even though these values are supposed to be hidden or redacted.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers with Extended Read permission to access encrypted secret values that should normally be hidden.

If an attacker can view these secrets, they might be able to misuse sensitive information such as passwords, tokens, or keys stored in the Jenkins job configurations.

This could lead to unauthorized access, privilege escalation, or compromise of other systems that rely on these secrets.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows attackers with Extended Read permission to view encrypted secret values that should otherwise be redacted in historical job and agent configurations.

Exposure of encrypted secrets could lead to unauthorized access to sensitive information, which may impact compliance with data protection standards such as GDPR and HIPAA that require protection of sensitive data.

However, specific impacts on compliance are not detailed in the provided information.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability affects Jenkins Job Configuration History Plugin version 1356.ve360da_6c523a_ and earlier. Detection involves identifying if this specific plugin and version is installed on your Jenkins instance.

You can check the installed plugin version via Jenkins script console or CLI commands.

• Using Jenkins Script Console: Run the Groovy script `println(jenkins.model.Jenkins.instance.getPluginManager().getPlugin('job-configuration-history').getVersion())` to get the installed version.
• Using Jenkins CLI: Execute `java -jar jenkins-cli.jar -s http://your-jenkins-url/ list-plugins | grep job-configuration-history` to see the installed version.

If the version is 1356.ve360da_6c523a_ or earlier, your system is vulnerable.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade the Jenkins Job Configuration History Plugin to a version later than 1356.ve360da_6c523a_ where the issue is fixed.

Additionally, restrict Extended Read permissions only to trusted users, as the vulnerability allows attackers with this permission to view encrypted secret values.

• Upgrade the Job Configuration History Plugin to the latest available version.
• Review and limit Extended Read permissions in Jenkins to minimize exposure.
• Monitor Jenkins logs and audit access to job and agent configurations for suspicious activity.

Useful 0 Not Useful 0