GHSA-JWR9-H4JM-C9CH

Vulnerability from github – Published: 2022-05-24 17:44 – Updated: 2022-12-14 16:27
VLAI?
Summary
Missing permission checks in Jenkins CloudBees AWS Credentials Plugin allows enumerating credentials IDs
Details

CloudBees AWS Credentials Plugin 1.28 and earlier does not perform a permission check in a helper method for HTTP endpoints.

This allows attackers with Overall/Read permission to enumerate credentials IDs of AWS credentials stored in Jenkins if any of the following plugins are installed:

Credentials IDs obtained this way can be used as part of an attack to capture the credentials using another vulnerability.

CloudBees AWS Credentials Plugin 1.28.1 performs permission checks in the helper method for HTTP endpoints.

Severity ?
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.28"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.jenkins-ci.plugins:aws-credentials"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.28.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-21625"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-12-14T16:27:02Z",
    "nvd_published_at": "2021-03-18T14:15:00Z",
    "severity": "MODERATE"
  },
  "details": "CloudBees AWS Credentials Plugin 1.28 and earlier does not perform a permission check in a helper method for HTTP endpoints.\n\nThis allows attackers with Overall/Read permission to enumerate credentials IDs of AWS credentials stored in Jenkins if any of the following plugins are installed:\n\n- [Amazon Elastic Container Service (ECS) / Fargate](https://plugins.jenkins.io/amazon-ecs)\n- [AWS Parameter Store Build Wrapper](https://plugins.jenkins.io/aws-parameter-store)\n- [AWS SAM](https://plugins.jenkins.io/aws-sam)\\n\\nFurther plugins may use this helper method as well without performing a permission check themselves.\n\nCredentials IDs obtained this way can be used as part of an attack to capture the credentials using another vulnerability.\n\nCloudBees AWS Credentials Plugin 1.28.1 performs permission checks in the helper method for HTTP endpoints.",
  "id": "GHSA-jwr9-h4jm-c9ch",
  "modified": "2022-12-14T16:27:02Z",
  "published": "2022-05-24T17:44:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21625"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jenkinsci/aws-credentials-plugin/commit/dd477a071bd633d9118c63dc3f19a2fd0590aecb"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jenkinsci/aws-credentials-plugin"
    },
    {
      "type": "WEB",
      "url": "https://www.jenkins.io/security/advisory/2021-03-18/#SECURITY-2032"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2021/03/18/5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Missing permission checks in Jenkins CloudBees AWS Credentials Plugin allows enumerating credentials IDs"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.