Mind your Logs: How a build log from a Jenkins leaked everything

https://medium.com/@aseem.shrey/mind-your-logs-how-a-build-log-from-a-jenkins-leaked-everything-603cf07fa85

by LuD1161 • 7 years ago

101 23 7 years ago

medium.com

malux852• 7 years ago

Why are these Jenkins servers exposed to the public internet?

Serves them right for such sloppy ops

alfiedotwtf• 7 years ago

You wouldn't believe how many there are, open to the public. Even more so are the ones that allow shell access ️

nineteen999• 7 years ago

Also, there's a Jenkins Mask Passwords plugin which we use in conjunction with not exposing our Jenkins server to the Internet. Plus its worthwhile wrapping Jenkins with TLS.

https://wiki.jenkins.io/display/JENKINS/Mask+Passwords+Plugi...

brazzy• 7 years ago

The article specifically mentions that the Jenkins in question had this plugin active, but it failed to catch all sensitive secrets.

dirkf• 7 years ago

It doesn't necessarily have to be the case.

I've contributed a few small patches to some well-known open-source projects. In the months after that I've received a few automated mails from some CI systems informing me about some (un)successful build. Probably because somewhere somebody integrated a new version of said open-source projects in their product and the system is configured to mail every committer the outcome of the CI pipeline, regardless of whether that committer is actually an employee... Still sloppy ops though.

malux852• 7 years ago

How is that relevant to what I'm talking about?

I'm talking about non-firewalled open ports on a jenkins server connected to the public internet.

You're talking on about some auto-emails and a bug where too many committers were emailed.

How are those things even remotely related?

duncanawoods• 7 years ago

Are there any good guides for setting up private networks? Google results are overwhelmed by setting up VPNs for private browsing.

oblio• 7 years ago

The easy way is to set up some sort of router, most of them NAT and block port forwarding. That way you can only access your Jenkins from the local network.

Avamander2• 7 years ago

Set up a network, don't make it public. Block everything incoming except your VPN tunnel should you need remote access. That's how a private network works.

cldellow• 7 years ago

+1. Jenkins even has an authenticated mode, but their code quality is so inconsistent that even that's not enough.

When we investigated in 2015, we found an average of 3 remote code execution / escalation of privilege CVEs per year in the previous 4 years. Looking at [1], I see the trend is still not great - 30 CVEs in 2018.

Fundamentally, it seems to me that Jenkins does not have the mindset to do security well. This isn't surprising given its plugin architecture permits random code to run. Isolate it behind a proxy server like https://github.com/pusher/oauth2_proxy and sleep better at night.

[1] https://www.cvedetails.com/vulnerability-list/vendor_id-1586...

Stratoscope• 7 years ago

As I was reading the article, I found the author mentioned some of the dorks for Jenkins and Sonarqube.

I wonder if anyone could explain what "dork" means in this context? My searches are only finding the common derogatory meaning, e.g. "a socially inept person."

qiqitori• 7 years ago

Did some Googling myself and found some related links:

https://www.wsj.com/articles/a-hacker-and-the-perils-of-dork...

https://pentestmag.com/zeus-scanner-advanced-dork-searching/

https://github.com/E4rr0r4/XGDork

https://github.com/GuestGuri/dork-scanner

https://www.darknet.org.uk/2017/10/sqliv-sql-injection-dork-...

jcims• 7 years ago

Also https://www.exploit-db.com/google-hacking-database

andimm• 7 years ago

I found this small explanation

Google “Dorking” is the practice of using Google to find vulnerable web applications and servers by using native Google search engine capabilities. [0]

[0] https://securitytrails.com/blog/google-hacking-techniques

o-__-o• 7 years ago

The only thing that keeps popping into my mind as I read this: is it illegal to hack foreign computer systems?

What are the varying levels of legality? (e.g. hacking a French company would see you extradited, hacking Iran/North Korea could bring Federal charges, but Russia.. China..?)

kube-system• 7 years ago

There are enough laws in most places thoroughly covering these kinds of activities that you can safely assume it’s breaking at least some law in some jurisdiction.

And even if you wouldn’t be in the jurisdiction that prohibits it and/or wouldn’t be extradited for it, that doesn’t technically make it legal.

thenewnewguy• 7 years ago

Most laws don't care about the nationality of the victim - i.e. in a legal sense yes it is illegal. Whether or not the governments would work together to extradite/charge you, on the other hand, is a different story.

johannes1234321• 7 years ago

Most likely your home country has laws against hacking. A foreign entity propaply can sue you in your home.

eb0la• 7 years ago

Usually if $SOMETHING is a crime in both countries, you can get extradited easily.

If $SOMETHING is not a crime in one of the countries you can be liable for damages only, buy I am not sure if this is sufficient to be extradited.

lol768• 7 years ago

I feel like the poking around on Slack crossed the line a bit. Should've gone to be disclosed responsibly before it go to that point.

kfichter• 7 years ago

+1, significantly over the line IMO. Seems (maybe?) OK to check token permissions if only to avoid the hassle of reporting a dead token.

Mind your Logs: How a build log from a Jenkins leaked everything

Related Stories