CVE-2018-1000600

HIGHNuclei

CSRF vulnerability and missing permission checks in GitHub Plugin allowed capturing credentials

Title source: GitHub Advisory
STIX 2.1 vulnerability

Record summary

CVE-2018-1000600 has a selected CVSS score of 8.8 (high); EIP currently links 1 Nuclei template.

Description

A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.1 and earlier in GitHubTokenCredentialsCreator.java that allows attackers to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Sep 19, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

2
ProductSourceVersion range

github

Browse Jenkins / github
VulnCheckVersion data not supplied

com.coravy.hudson.plugins.github:github

Browse Maven / com.coravy.hudson.plugins.github:github
GitHub AdvisoryBefore 1.29.2 · Fixed in 1.29.2affected

Nuclei templates

1
ProjectDiscoveryHIGHJenkins GitHub Plugin <=1.29.1 - Server-Side Request ForgeryCVSS 8.8

Jenkins GitHub Plugin 1.29.1 and earlier is susceptible to server-side request forgery via GitHubTokenCredentialsCreator.java, which allows attackers to leverage attacker-specified credentials IDs obtained through another method and capture the credentials stored in Jenkins.

Impact

Successful exploitation of this vulnerability can lead to unauthorized access to internal resources, potential data leakage, and further attacks on the network.

Remediation

Upgrade Jenkins GitHub Plugin to version 1.29.2 or later to mitigate the vulnerability.

WeaknessesCWE-200
Authorsgeeknik
Template tagscvecve2018jenkinsssrfoastgithubvkevvuln
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:jenkins:github:*:*:*:*:*:jenkins:*:*
https://www.jenkins.io/security/advisory/2018-06-25/#SECURITY-915 https://devco.re/blog/2019/01/16/hacking-Jenkins-part1-play-with-dynamic-routing/ https://jenkins.io/security/advisory/2018-06-25/#SECURITY-915 https://nvd.nist.gov/vuln/detail/CVE-2018-1000600 https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

4