Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-50242

withCredentials step masking easily bypassed

    XMLWordPrintable

Details

    • Bug
    • Resolution: Not A Defect
    • Major
    • credentials-binding-plugin
    • None
    • Jenkins: 2.111
      Plugin: 1.15

    Description

      A very common use case of Jenkins is to delegate the responsibility of the creation of pipelines to third parties or developers. These external teams should be able to use secrets given to them via Jenkins credentials, but shouldn't be able to visualize the value of the secret.

      For this use case, withCredentials is broken:

      node {
  stage('Break Security') {
    withCredentials([string(credentialsId: 'AWS_DEFAULT_REGION', variable: 'AWS_DEFAULT_REGION'),
    string(credentialsId: 'AWS_ACCESS_KEY_ID', variable: 'AWS_ACCESS_KEY_ID'),
    string(credentialsId: 'AWS_SECRET_ACCESS_KEY', variable: 'AWS_SECRET_ACCESS_KEY')]) {
      def exposedSecret = ""
      for(letter in env.AWS_SECRET_ACCESS_KEY) {
        exposedSecret = "$exposedSecret $letter"
      }
      echo "$exposedSecret"
    }
  }
}

      The secret can be easily viewed.

      Letting someone work on a pipeline is basically showing them the secrets that pipeline uses.
      For this example I used "Secret Text", but it also happens with "AWS Credentials".

      Attachments

        Issue Links

          is duplicated by

          Bug - A problem which impairs or prevents the functions of the product. JENKINS-60962 credential plugin security issue

          • Blocker - Blocks development and/or testing work, production could not run.
          • Closed
          relates to

          Bug - A problem which impairs or prevents the functions of the product. JENKINS-54538 Ability to save unmasked credentials to file

          • Major - Major loss of function.
          • Closed

          Improvement - An improvement or enhancement to an existing feature or task. JENKINS-61277 Document that Bitbucket Server admin token credential secures itself by forcing to SYSTEM scope

          • Minor - Minor loss of function, or other problem where easy workaround is present.
          • Open
          links to

          Web Link PR 49

          mentioned in

          Page Loading...

          Activity

            People

              Unassigned Unassigned
              apineros Andres Pineros
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: