-
Improvement
-
Resolution: Fixed
-
Minor
-
Platforms: Jenkins
Versions: 1.622
Submitting as delegate for a Cisco pen-testing team
This is an enhancement to improve the security posture of the default Jenkins install.
Headline: Disable Jenkins API tokens by default
Platforms: Jenkins
Versions: 1.622
CWE Tags: CWE-671, CWE-424
Jenkins allows users to authenticate via multiple mechanisms, including an
automatically generated API token. Despite the name, the API token provides
users with a fully authenticated session (the same as if the user had logged in
using a password).
In many common usage scenarios, a user may never require an API token. For
example, a user who exclusively accesses Jenkins via the web-based UI will never
use an API token. Although probably less common, a user who exclusively
utilizes the SSH-based Jenkins CLI will also never use an API token.
In scenarios such as these, the existence of an active API token serves no
purpose to the user and represents a weakness in that it broadens the overall
attack surface. For this reason, API tokens should not be generated for users
unless they explicitly request a token. Furthermore, individual users should
have the ability to remove/disable existing API tokens. Lastly, Jenkins
administrators should be able to remove a user's API token (e.g. if the token
has been compromised) and disable the usage of API tokens system-wide.
References:
http://cwe.mitre.org/data/definitions/424.html
http://cwe.mitre.org/data/definitions/671.html
- relates to
-
JENKINS-52161 [API token] Manage Legacy API Token usage UX date since use labeling should be restructured
-
- Resolved
-
-
JENKINS-32776 Jenkins shouldn't store API tokens in a recoverable format
-
- Resolved
-
- links to
[JENKINS-32442] Disable Jenkins API tokens by default
Component/s | New: core [ 15593 ] | |
Component/s | Original: core [ 15738 ] | |
Key |
Original:
|
New:
|
Workflow | Original: Security v1.2 [ 168063 ] | New: JNJira [ 168063 ] |
Project | Original: Security Issues [ 10180 ] | New: Jenkins [ 10172 ] |
Status | Original: Untriaged [ 10001 ] | New: Open [ 1 ] |
Labels | New: security split-plugins-from-core |
Workflow | Original: JNJira [ 168072 ] | New: JNJira + In-Review [ 182953 ] |
Link |
New:
This issue relates to |
Status | Original: Open [ 1 ] | New: In Progress [ 3 ] |
Remote Link | New: This issue links to "#3271 core (Web Link)" [ 20059 ] |
Link |
New:
This issue relates to |
Assignee | New: Wadeck Follonier [ wfollonier ] | |
Resolution | New: Fixed [ 1 ] | |
Status | Original: In Progress [ 3 ] | New: Resolved [ 5 ] |