[R2] Jenkins Forced Migration of User Records

Tenable discovered a vulnerability in Jenkins which allows valid user folders to be migrated. This can be exploited by a remote unauthenticated attacker.

Attempting to authenticate as a valid user (e.g. admin), preceded by a relative path that leads to the same user account folder on the file system (admin, /admin, ./admin, ../users/admin, etc) will force Jenkins to migrate that user's folder to the sanitized version of the relative path used.

This effectively creates a clone of the original user's config file and user account under a new user id, and deletes the user's original folder. The original user's account will persist until the Jenkins service restarts, after which point the original user will no longer be able to login under their original username. This method is a particularly dangerous when combined with the unauthenticated user enumeration possible in 2.121.2 LTS, as the process of migrating all users could be automated.

As a proof of concept, consider the following URL:

http://[ip]:[port]/securityRealm/user/..%2fusers%2fadmin

When visited, the following can be observed in the Jenkins log:

INFO hudson.model.User getOrCreate
Migrated user record from C:\Program Files (x86)\Jenkins\users\..\users\admin\config.xml to C:\Program Files (x86)\Jenkins\users\..$002fusers$002fadmin\config.xml