Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-24287

EnvInject exposes password hashes

XMLWordPrintable

      Currently, if a user without configuration access to a job can read the job they have access to the link "Environment variables". This allows the non-privileged user to see the password hashes.

      If they have Config access to a different folder on the same master, they can use this password hash to expose the password and take control of the account by using the CLI to directly change the job config.xml

      I propose that this link or at least the password hashes be restricted to only users with job config access.

        1. EnvInject.png
          EnvInject.png
          60 kB
        2. config.xml
          10 kB

          [JENKINS-24287] EnvInject exposes password hashes

          Walter Kacynski created issue -

          Daniel Beck added a comment -

          they can use this password hash to expose the password and take control of the account

          Could you provide steps to reproduce this?

          Daniel Beck added a comment - they can use this password hash to expose the password and take control of the account Could you provide steps to reproduce this?
          Daniel Beck made changes -
          Labels New: security

          Walter Kacynski added a comment -

          I think that I forgot to mention that you need to configure a global password or use job level passwords from this plugin. Doing these options will show the environment variable as injected which cause this security problem.

          Walter Kacynski added a comment - I think that I forgot to mention that you need to configure a global password or use job level passwords from this plugin. Doing these options will show the environment variable as injected which cause this security problem.
          Walter Kacynski made changes -
          Attachment New: EnvInject.png [ 26605 ]
          Attachment New: config.xml [ 26606 ]

          Daniel Beck added a comment -

          This still doesn't explain how other users that

          have Config access to a difference folder on the same master, ... can use this password hash to expose the password and take control of the account

          Daniel Beck added a comment - This still doesn't explain how other users that have Config access to a difference folder on the same master, ... can use this password hash to expose the password and take control of the account

          Walter Kacynski added a comment -

          They can use the CLI to retrieve the config.xml and then paste this hash into the document and then update the job back to jenkins.

          Walter Kacynski added a comment - They can use the CLI to retrieve the config.xml and then paste this hash into the document and then update the job back to jenkins.

          Daniel Beck added a comment -

          Thanks for the explanation, makes sense. passwords should probably be hidden from this output completely, or just have the value (password hidden) or similar.

          Daniel Beck added a comment - Thanks for the explanation, makes sense. passwords should probably be hidden from this output completely, or just have the value (password hidden) or similar.
          Walter Kacynski made changes -
          Description Original: Currently, if a user without configuration access to a job can read the job they have access to the link "Environment variables". This allows the non-privileged user to see the password hashes.

          If they have Config access to a difference folder on the same master, they can use this password hash to expose the password and take control of the account.

          I propose that this link or at least the password hashes be restricted to only users with job config access.           		New: Currently, if a user without configuration access to a job can read the job they have access to the link "Environment variables". This allows the non-privileged user to see the password hashes.

          If they have Config access to a different folder on the same master, they can use this password hash to expose the password and take control of the account by using the CLI to directly change the job config.xml

          I propose that this link or at least the password hashes be restricted to only users with job config access.
          Jesse Glick made changes -
          Link New: This issue is related to JENKINS-23447 [ JENKINS-23447 ]

            oleg_nenashev Oleg Nenashev
            walterk82 Walter Kacynski
            Votes:
            1 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated:
              Resolved: