1450914 - https://relman-ci.mozilla.org is hosting a public Jenkins instance

Status: RESOLVED INVALID

(Release Engineering :: Release Automation, defect)

Description

[chaos_le_red]

Anyone is able to access the admin dashboard of your jenkins product. There is no username and password set.


This can lead to 
- Unauthorized access
- Breach Of CIA
- Information loss
- Access escalation and much high risks


Fix/Solution:
Add a authorization/authentication



Steps to reproduce:

just visit.

Comment 1

[chaos_le_red]

Jenkins is an open source automation server written in Java. Jenkins helps to automate the non-human part of the software development process, with continuous integration and facilitating technical aspects of continuous delivery. 


Since there is admin access, it is possible to install plugins, execute jenkins code... etc :)


Which is very risky ofcourse...

you need to set a proper authentication/authorization as soon as you can...

http://prntscr.com/j06ogu <-- Proof that i got access.


Steps to reproduce:

1) Open your browser.
2) https://relman-ci.mozilla.org <--- Visit this link
3) You will automatically get admin access, as by default there is no username/password set on your jenkins product....
4) Congratulations, you've gained admin access!


Attack Scenario:
Jim is a hacker with malicious intentions, he finds this link, he gets admin access and he plays with the plugins and stuff in your jenkins server, which messes everything up

Comment 2

[Jonathan Claudius [:claudijd] (use NEEDINFO)]

chaos_le_red: Thanks for your report.  Based on your screenshot and my own visiting of the site, it appears as though what you're viewing is "read-only" access to Jenkins.  Yes, this provides the ability to users to attempt login, but your screenshot does not demonstrate a logged in session.  I can see ways for us to improve the security on this site (maybe perhaps make this non-public or add strong authentication controls), and will ask the service owner to review their options, but I believe your claim of an auth bypass is incorrect.  I do welcome you to provide evidence that suggests otherwise, as what you claim would be a serious issue if you could demonstrate it.

Comment 3

[chaos_le_red]

Hey there, 

Thank you for your reply.

By default, Jenkins has no authentication set and it seems the site owner is using the default setting due to which there is no authentication out there which makes confidential information leak to public.

If you take a look at the application, you can see some sensitive data being leaked. It is not a authorization bypass but is ofcourse a Lack of authorization/authentication (Security misconfiguration) 


I am not logged in because, the login is disabled by default since no credentials are set by the site owner.


I request you to file a bug based on this and ask the site owner to make proper authentication/authorization settings.

Comment 4

[chaos_le_red]

Reference:https://wiki.jenkins.io/display/JENKINS/Securing+Jenkins

Comment 5

[Sylvestre Ledru [:Sylvestre]]

Could you please let us know what kind of confidential information you saw? Thanks

Comment 6

[Jonathan Claudius [:claudijd] (use NEEDINFO)]

chaos_le_red: I believe your assessment that this site does not have authentication is incorrect.  I do invite you to provide evidence of being able to say create a job and take a screenshot to demonstrate your claim.  I'm also interested in whether you can demonstrate any sensitive data leak on these jobs, again with evidence.

Comment 7

[chaos_le_red]

1) I can see all the users  along with their name and email
https://relman-ci.mozilla.org/asynchPeople/
2) I can see console output of various projects
https://relman-ci.mozilla.org/job/firefox-scan-build/1120/console
3) I can see build information of various projects and access your projects data
https://relman-ci.mozilla.org/job/firefox-scan-build/1120/configure
4) I have access to credentials tab which shows credenyials of SSH with private key

Comment 8

[chaos_le_red]

I am not able to do any actions there, i agree but i can still view information.

Are all those information above meant to be public?

Comment 9

[Sylvestre Ledru [:Sylvestre]]

(In reply to chaos_le_red from comment #7)
> 1) I can see all the users  along with their name and email
> https://relman-ci.mozilla.org/asynchPeople/
This is extract from the git lob. These information are available on github too.

> 2) I can see console output of various projects
> https://relman-ci.mozilla.org/job/firefox-scan-build/1120/console
This is by design. I don't have any reason to hide it.
There is no confidential information here.

> 3) I can see build information of various projects and access your projects
> data
> https://relman-ci.mozilla.org/job/firefox-scan-build/1120/configure
Same as 2)

> 4) I have access to credentials tab which shows credenyials of SSH with
> private key
Could you please share the URL or the data?

Comment 10

[chaos_le_red]

https://relman-ci.mozilla.org/credentials/store/system/domain/_/

Comment 11

[Jonathan Claudius [:claudijd] (use NEEDINFO)]

(In reply to chaos_le_red from comment #10)
> https://relman-ci.mozilla.org/credentials/store/system/domain/_/

This does not expose the key itself, you're simply seeing a reference to it.  If you could demonstrate actually viewing the key (like the actual secret) then I would agree it's issue, but I don't believe that is the case here.

Comment 12

[chaos_le_red]

I see :/


So this is not valid?

Comment 13

[Jonathan Claudius [:claudijd] (use NEEDINFO)]

chaos_le_red: Although we appreciate your report and recognize there might be ways to improve the security posture of this site, the issues you raised (auth bypass and confidential information disclosure) were not substantiated with evidence and in our investigation and poking around the site on our own, we were not able to verify the claim.  Because of this, I'm marking the bug invalid.

Comment 14

[chaos_le_red]

Can you take a possible suggestion to add a login page if possible?

Comment 15

[Jonathan Claudius [:claudijd] (use NEEDINFO)]

Attachment: Screen_Shot_2018-04-03_at_10_44_55_AM.png

Comment 16

[Jonathan Claudius [:claudijd] (use NEEDINFO)]

chaos_le_red: I have added an screenshot of the page, which demonstrates where one would login.  The intent of having the jobs be publicly readable is fully intentional by the service owner, so requiring a full screen login before seeing the job status' runs counter to what they are trying to achieve.  I hope that helps explain the context a bit better.

Comment 17

[chaos_le_red]

Okay, Can you click on that login and show me you getting navigated to login page?

Comment 18

[Jonathan Claudius [:claudijd] (use NEEDINFO)]

Attachment: Screen Shot 2018-04-03 at 10.51.50 AM.png

Comment 19

[chaos_le_red]

Weird, it didnt redirect me..

Anyway, sorry for reporting the false positive stuff and thank you for your valuable time..

Comment 20

[Jonathan Claudius [:claudijd] (use NEEDINFO)]

(In reply to chaos_le_red from comment #19)
> Weird, it didnt redirect me..
> 
> Anyway, sorry for reporting the false positive stuff and thank you for your
> valuable time..

No worries, thanks for reaching out.  Better safe than sorry.