Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to a login command which allowed impersonating any Jenkins user. The `login` command available in the remoting-based CLI stored the encrypted user name of the successfully authenticated user in a cache file used to authenticate further commands. Users with sufficient permission to create secrets in Jenkins, and download their encrypted values (e.g. with Job/Configure permission), were able to impersonate any other Jenkins user on the same instance.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to a login command
    which allowed impersonating any Jenkins user. The `login` command available in the remoting-based CLI
    stored the encrypted user name of the successfully authenticated user in a cache file used to authenticate
    further commands. Users with sufficient permission to create secrets in Jenkins, and download their
    encrypted values (e.g. with Job/Configure permission), were able to impersonate any other Jenkins user on
    the same instance. (CVE-2017-1000354)

The version of Jenkins running on the remote web server is prior to 2.57 or is a version of Jenkins LTS prior to 2.46.2, or else it is a version of Jenkins Enterprise that is 1.625.x.y prior to 1.625.24.1, 1.651.x.y prior to 1.651.24.1, 2.7.x.0.y prior to 2.7.24.0.1, or 2.x.y.z prior to 2.46.2.1. It is, therefore, affected by multiple vulnerabilities :

  - A remote code execution vulnerability exists within     core/src/main/java/jenkins/model/Jenkins.java that     allows an untrusted serialized Java SignedObject to be     transfered to the remoting-based Jenkins CLI and     deserialized using a new ObjectInputStream. By using a     specially crafted request, an unauthenticated, remote     attacker can exploit this issue to bypass existing     blacklist protection mechanisms and execute arbitrary     code. (CVE-2017-1000353)

  - A flaw exists in the remoting-based CLI, specifically in     the ClientAuthenticationCache.java class, when storing     the encrypted username of a successfully authenticated     user in a cache file that is used to authenticate     further commands. An authenticated, remote attacker who     has sufficient permissions to create secrets in Jenkins     and download their encrypted values can exploit this     issue to impersonate any other Jenkins user on the same     instance. (CVE-2017-1000354)

  - A denial of service vulnerability exists in the XStream     library. An authenticated, remote attacker who has     sufficient permissions, such as creating or configuring     items, views or jobs, can exploit this to crash the Java     process by using specially crafted XML content.
    (CVE-2017-1000355)

  - Cross-site request forgery (XSRF) vulnerabilities exist     within multiple Java classes due to a failure to require     multiple steps, explicit confirmation, or a unique token     when performing certain sensitive actions. An     unauthenticated, remote attacker can exploit these to     perform several administrative actions by convincing a     user into opening a specially crafted web page.
    (CVE-2017-1000356)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Jenkins Security Advisory : DescriptionSECURITY-412 through SECURITY-420 / CVE-2017-1000356 CSRF: Multiple vulnerabilities SECURITY-429 / CVE-2017-1000353 CLI: Unauthenticated remote code execution SECURITY-466 / CVE-2017-1000354 CLI: Login command allowed impersonating any Jenkins user SECURITY-503 / CVE-2017-1000355 XStream: Java crash when trying to instantiate void/Void

ID	Name	Product	Family	Severity
418496	SCA: security update for org.jenkins-ci.main:jenkins-core (GHSA-r57f-7xw3-q2r9)	Tenable Cloud Security	SCA Checks	high
418496	SCA: security update for org.jenkins-ci.main:jenkins-core (GHSA-r57f-7xw3-q2r9)	Tenable Self-Hosted Container Security	SCA Checks	high
99984	Jenkins < 2.46.2 / 2.57 and Jenkins Enterprise < 1.625.24.1 / 1.651.24.1 / 2.7.24.0.1 / 2.46.2.1 Multiple Vulnerabilities	Nessus	CGI abuses	critical
99698	FreeBSD : jenkins -- multiple vulnerabilities (631c4710-9be5-4a80-9310-eb2847fe24dd)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2017-1000354

high

Tenable Plugins

high

high

critical

critical