1230360 - Default Jenkins Install w/ No authentication enabled

Status: RESOLVED FIXED

(Websites :: Other, defect)

Description

[Griffin Francis]

User Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.86 Safari/537.36

Steps to reproduce:

Visit - https://52.27.207.28/manage


Actual results:

Able to manage the whole Jenkins instance. I could deploy a remote shell via Netcat on the server if I wanted.


Expected results:

User should be authenticated. Should not allow me to manage the whole application

Comment 1

[Jonathan Claudius [:claudijd] (use NEEDINFO)]

@Griffin: Thanks for the heads up!

I've temporarily enabled security to prevent any further compromise until we can contact the system owner.

Comment 2

[Griffin Francis]

No worries mate. Thanks for the quick turnaround time.

Comment 3

[Gene Wood [:gene]]

:whd is this IP 52.27.207.28 a cloud services box? I can scan all accounts but Cloud Services accounts.

Comment 4

[Jonathan Claudius [:claudijd] (use NEEDINFO)]

Instructions for the system owner to recover the Jenkins setup, which currently requires auth, but doesn't have an account setup:

1.) Follow the instructions here https://wiki.jenkins-ci.org/display/JENKINS/Disable+security to recover the UI
2.) Create a user account
3.) Reenable security via global configuration and at minimum force Jenkins to use a local database for user auth and make sure to disable the sign-up feature

Lastly, consider upgrading to the latest version Jenkins, this install is also outdated.

Comment 5

[Wesley Dawson [:whd]]

I just checked our four IAMs and this doesn't appear to be a cloud services box. I'm guessing from the cert name that this is related to crash stats so I'm adding :lonnen.

Comment 6

[JP Schneider [:jp]]

Ah, those were old test servers taht were still up.  Thanks for the eyes!  Those are shut down.

Comment 7

[Griffin Francis]

No worries. You are most welcome. Bug Bounty flag review?

Comment 8

[JP Schneider [:jp]]

I will personally pay that bounty.  I want to say thanks again for catching that, and helping keep eyes on my kit!  

Can we please work out how to get you some funds/bounty?

Comment 9

[Griffin Francis]

Hi mate. You are most welcome. I am looking over some other Mozilla services also. I will let you know if I find anything new.

It's been awhile, I am not sure how stuff is handled now. I was last sent a Bounty in 2013 and a damn awesome Mozilla shirt. :) I think we need to set a Flag on this ticket?

Comment 10

[Gene Wood [:gene]]

Wes indicated yesterday :

whd> gene: ok lonnen is aware and handling it, apparently that box blew up last night and in the restore some auth setting was hosed.

Comment 11

[Gene Wood [:gene]]

Both JP and lonnen have claimed ownership of this IP so I'm not sure who's box it actually is.

Comment 12

[Gene Wood [:gene]]

Heh whoops. JP works for Chris. Nevermind. They're talking about the same system.

Comment 13

[Al Billings [:abillings - ex-MoCo]]

JP, when is this issue likely to be addressed?

Comment 14

[Griffin Francis]

This issue is addressed Al. Just the second issue which I reported hasn't.

Comment 15

[JP Schneider [:jp]]

Yes, we are just needing the bounty paid.  As I said, I'm happy to pay it out of pocket, because this makes my job much easier.  If he's not paid out within a week, I'll just take care of it.

Comment 16

[Al Billings [:abillings - ex-MoCo]]

Bounty team will make a determination when we meet next, which should be next week.

Comment 17

[Jonathan Claudius [:claudijd] (use NEEDINFO)]

Lifting security flag at the request of the submitter, bug is fixed