Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-35967

Hardening: Jenkins should not allow creating users like " system " or "anonymous "

    • Icon: Improvement Improvement
    • Resolution: Fixed
    • Icon: Minor Minor
    • core
    • None

      Got into case during the fix of JENKINS-33600. I do not see any exploits in the code, but seems SECURITY-166 by campbellr was not enough aggressive in String checking.

      This code allows non-trimmed restricted usernames, hence I was able to create the " anonymous " account with "Anonymous " full name. The same can be done for SYSTEM as well. UIs do not present such trailing spaces, hence UI looks to be "fine"

      I have not obvious exploits in the code, but this logic gap may be a security issue if a plugin does not work with user IDs with spaces.

      Is it a security issue or should we handle it as a common bug?

          [JENKINS-35967] Hardening: Jenkins should not allow creating users like " system " or "anonymous "

          Oleg Nenashev created issue -
          Oleg Nenashev made changes -
          Summary Original: Jenkins allows creating users like " system " or "anonymous" New: Jenkins allows creating users like " system " or "anonymous "
          Jesse Glick made changes -
          Link New: This issue is related to SECURITY-166 [ SECURITY-166 ]
          Oleg Nenashev made changes -
          Component/s New: core [ 15593 ]
          Component/s Original: core [ 15738 ]
          Key Original: SECURITY-312 New: JENKINS-35967
          Workflow Original: Security v1.2 [ 171993 ] New: JNJira [ 172595 ]
          Project Original: Security Issues [ 10180 ] New: Jenkins [ 10172 ]
          Status Original: Untriaged [ 10001 ] New: Open [ 1 ]
          Oleg Nenashev made changes -
          Assignee New: Oleg Nenashev [ oleg_nenashev ]
          Oleg Nenashev made changes -
          Status Original: Open [ 1 ] New: In Progress [ 3 ]
          R. Tyler Croy made changes -
          Workflow Original: JNJira [ 172595 ] New: JNJira + In-Review [ 185774 ]
          Oleg Nenashev made changes -
          Link New: This issue is related to JENKINS-39009 [ JENKINS-39009 ]
          SCM/JIRA link daemon made changes -
          Resolution New: Fixed [ 1 ]
          Status Original: In Progress [ 3 ] New: Resolved [ 5 ]
          Oleg Nenashev made changes -
          Issue Type Original: Bug [ 1 ] New: Improvement [ 4 ]
          Oleg Nenashev made changes -
          Summary Original: Jenkins allows creating users like " system " or "anonymous " New: Hardening: Jenkins should not allow creating users like " system " or "anonymous "

            oleg_nenashev Oleg Nenashev
            oleg_nenashev Oleg Nenashev
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated:
              Resolved: