Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-23627

Overall.READ is sufficient to access /administrativeMonitor/hudsonHomeIsFull/

XMLWordPrintable

      This does not appear to really be an issue by itself, but it might be in the case of carelessly implemented Solution's to this problem that don't check permissions in message.jelly and expose private data on the overview page (even if checking permissions for any associated actions).

          [JENKINS-23627] Overall.READ is sufficient to access /administrativeMonitor/hudsonHomeIsFull/

          Daniel Beck created issue -

          Daniel Beck added a comment -

          It also exposes the path to JENKINS_HOME which will reveal master OS and could reveal configuration details. I don't think this should be public.

          Daniel Beck added a comment - It also exposes the path to JENKINS_HOME which will reveal master OS and could reveal configuration details. I don't think this should be public.

          Daniel Beck added a comment -

          Like SECURITY-133, this is fairly harmless and a fix can probably be released in a regular release. Again, let me know if I should not release the fix.

          $ git show e7f72e5
commit e7f72e502377138a36e65d52d3c2b7311b07a5ec
Author: Daniel Beck <daniel-beck@github.com>
Date:   Sun May 11 00:19:45 2014 +0200

    [FIX SECURITY-134] Restrict access to admin monitor info page
    
    This could contain sensitive information in the list of solutions
    provided. It also shows the path to JENKINS_HOME, exposing OS and
    configuration information.

diff --git a/core/src/main/resources/hudson/diagnosis/HudsonHomeDiskUsageMonitor/index.jelly b/core/src/main/resources/hudson/diagnosis/Hudso
index fb29dd5..eb39bea 100644
--- a/core/src/main/resources/hudson/diagnosis/HudsonHomeDiskUsageMonitor/index.jelly
+++ b/core/src/main/resources/hudson/diagnosis/HudsonHomeDiskUsageMonitor/index.jelly
@@ -24,7 +24,7 @@ THE SOFTWARE.
 
 <?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form
-       <l:layout title="${%JENKINS_HOME is almost full}">
+       <l:layout title="${%JENKINS_HOME is almost full}" permission="${app.ADMINISTER}">
                <l:main-panel>
       <h1>
         <img src="${imagesURL}/48x48/warning.png" height="48" width="48" />

          Daniel Beck added a comment - Like SECURITY-133, this is fairly harmless and a fix can probably be released in a regular release. Again, let me know if I should not release the fix. $ git show e7f72e5 commit e7f72e502377138a36e65d52d3c2b7311b07a5ec Author: Daniel Beck <daniel-beck@github.com> Date: Sun May 11 00:19:45 2014 +0200 [FIX SECURITY-134] Restrict access to admin monitor info page This could contain sensitive information in the list of solutions provided. It also shows the path to JENKINS_HOME, exposing OS and configuration information. diff --git a/core/src/main/resources/hudson/diagnosis/HudsonHomeDiskUsageMonitor/index.jelly b/core/src/main/resources/hudson/diagnosis/Hudso index fb29dd5..eb39bea 100644 --- a/core/src/main/resources/hudson/diagnosis/HudsonHomeDiskUsageMonitor/index.jelly +++ b/core/src/main/resources/hudson/diagnosis/HudsonHomeDiskUsageMonitor/index.jelly @@ -24,7 +24,7 @@ THE SOFTWARE. <?jelly escape-by- default = ' true ' ?> <j:jelly xmlns:j= "jelly:core" xmlns:st= "jelly:stapler" xmlns:d= "jelly:define" xmlns:l= "/lib/layout" xmlns:t= "/lib/hudson" xmlns:f="/lib/form - <l:layout title= "${%JENKINS_HOME is almost full}" > + <l:layout title= "${%JENKINS_HOME is almost full}" permission= "${app.ADMINISTER}" > <l:main-panel> <h1> <img src= "${imagesURL}/48x48/warning.png" height= "48" width= "48" />
          Jesse Glick made changes -
          Status Original: Untriaged [ 10001 ] New: Open [ 1 ]
          Jesse Glick made changes -
          Status Original: Open [ 1 ] New: Fix Prepared [ 10002 ]
          Jesse Glick made changes -
          URL New: https://github.com/jenkinsci/jenkins/pull/1283

          Jesse Glick added a comment -

          Was merged for a regular release.

          Jesse Glick added a comment - Was merged for a regular release.
          Jesse Glick made changes -
          Resolution New: Fixed [ 1 ]
          Status Original: Fix Prepared [ 10002 ] New: Resolved [ 5 ]
          Jesse Glick made changes -
          Component/s New: core [ 15593 ]
          Component/s Original: core [ 15738 ]
          Key Original: SECURITY-134 New: JENKINS-23627
          Project Original: Security Issues [ 10180 ] New: Jenkins [ 10172 ]
          Workflow Original: Security v1.2 [ 154895 ] New: JNJira [ 156410 ]
          Jesse Glick made changes -
          Labels New: security

            kohsuke Kohsuke Kawaguchi
            danielbeck Daniel Beck
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated:
              Resolved: