TRUTH

API tokens of other users available to admins

SECURITY-200 / CVE-2015-5323

API tokens of other users were exposed to admins by default. On instances that don’t implicitly grant RunScripts permission to admins, this allowed admins to run scripts with another user’s credentials.

Affected versions

All Jenkins main line releases up to and including 1.637

All Jenkins LTS releases up to and including 1.625.1

PoC

Tested against Jenkins 1.6.37

From the script console:

run some groovy code to get the token of another user

wrong token

correct token

Print Share Comment Cite Upload Translate

APA

() » Jenkins – SECURITY-200 / CVE-2015-5323 PoC. Retrieved from https://www.truth.cx/2019/02/28/jenkins-security-200-cve-2015-5323-poc/.

MLA

" » Jenkins – SECURITY-200 / CVE-2015-5323 PoC." - , https://www.truth.cx/2019/02/28/jenkins-security-200-cve-2015-5323-poc/

HARVARD

» Jenkins – SECURITY-200 / CVE-2015-5323 PoC., viewed ,

VANCOUVER

- » Jenkins – SECURITY-200 / CVE-2015-5323 PoC. [Internet]. [Accessed ]. Available from: https://www.truth.cx/2019/02/28/jenkins-security-200-cve-2015-5323-poc/

CHICAGO

" » Jenkins – SECURITY-200 / CVE-2015-5323 PoC." - Accessed . https://www.truth.cx/2019/02/28/jenkins-security-200-cve-2015-5323-poc/

IEEE

" » Jenkins – SECURITY-200 / CVE-2015-5323 PoC." [Online]. Available: https://www.truth.cx/2019/02/28/jenkins-security-200-cve-2015-5323-poc/. [Accessed: ]

Select a language:

<div style="background-color: white; box-sizing: border-box; line-height: 1.2; margin-bottom: 0.5rem; margin-top: 0px;"><b><span style="font-family: inherit; font-size: large;">API tokens of other users available to admins</span></b><br /><div style="color: #212529;"><span style="font-family: inherit;"><br /></span><span style="font-family: inherit;">SECURITY-200 / CVE-2015-5323</span></div><div style="color: #212529;"><span style="font-family: inherit;"><br /></span><span style="font-family: inherit;">API tokens of other users were exposed to admins by default. On instances that don’t implicitly grant RunScripts permission to admins, this allowed admins to run scripts with another user’s credentials.</span></div><div style="color: #212529;"><span style="font-family: inherit;"><br /></span><span style="font-family: inherit;"><br /></span><b><span style="font-family: inherit;">Affected versions</span></b></div><div style="color: #212529;"><span style="font-family: inherit;">All Jenkins main line releases up to and including 1.637</span></div><div style="color: #212529;"><span style="font-family: inherit;"><br /></span><span style="font-family: inherit;">All Jenkins LTS releases up to and including 1.625.1</span></div><div style="color: #212529;"><span style="font-family: inherit;"><br /></span><b><span style="font-family: inherit;">PoC</span></b></div><div style="color: #212529;"><script src="https://gist.github.com/carnal0wnage/1f316c01eaa7707c3cc6497ef04857a8.js"></script><span style="font-family: inherit;"> Tested against Jenkins 1.6.37</span></div><div style="color: #212529;"><span style="font-family: inherit;"><br /></span><span style="font-family: inherit;"><br /></span><span style="font-family: inherit;">From the script console:</span></div><div class="sect2" style="background-color: white; box-sizing: border-box; color: #212529; text-align: left; text-indent: 0px;"><div class="paragraph" style="box-sizing: border-box;"><table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="color: #212529; font-style: normal; letter-spacing: normal; margin-left: auto; margin-right: auto; text-align: center; text-transform: none; white-space: normal; word-spacing: 0px;"><tbody><tr><td style="text-align: center;"><a href="https://2.bp.blogspot.com/-Ag04hKntnIc/XHclZb0VK_I/AAAAAAAACbM/r3XVddXgC58mSqqGlTm8rzM7zY6rBZMKwCLcBGAs/s1600/Screen%2BShot%2B2019-02-27%2Bat%2B6.59.18%2BPM.png" imageanchor="1" style="margin-left: auto; margin-right: auto;"><span style="font-family: "times" , "times new roman" , serif;"><img border="0" data-original-height="898" data-original-width="1600" height="356" src="https://2.bp.blogspot.com/-Ag04hKntnIc/XHclZb0VK_I/AAAAAAAACbM/r3XVddXgC58mSqqGlTm8rzM7zY6rBZMKwCLcBGAs/s640/Screen%2BShot%2B2019-02-27%2Bat%2B6.59.18%2BPM.png" width="640" /></span></a></td></tr><tr><td class="tr-caption" style="text-align: center;"><span style="font-family: "times" , "times new roman" , serif; font-size: small;">run some groovy code to get the token of another user</span></td></tr></tbody></table><div style="color: #212529; font-style: normal; letter-spacing: normal; text-transform: none; white-space: normal; word-spacing: 0px;"><span style="font-family: "times" , "times new roman" , serif;"><br /></span></div><table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="color: #212529; font-style: normal; letter-spacing: normal; margin-left: auto; margin-right: auto; text-align: center; text-transform: none; white-space: normal; word-spacing: 0px;"><tbody><tr><td style="text-align: center;"><a href="https://1.bp.blogspot.com/-lCfkcZ76NoU/XHclZfD8ipI/AAAAAAAACbE/xe7lBDNyWF4uwdz12LeD_iirhM1tKpPMQCLcBGAs/s1600/Screen%2BShot%2B2019-02-27%2Bat%2B6.59.33%2BPM.png" imageanchor="1" style="margin-left: auto; margin-right: auto;"><span style="font-family: "times" , "times new roman" , serif;"><img border="0" data-original-height="317" data-original-width="1600" height="124" src="https://1.bp.blogspot.com/-lCfkcZ76NoU/XHclZfD8ipI/AAAAAAAACbE/xe7lBDNyWF4uwdz12LeD_iirhM1tKpPMQCLcBGAs/s640/Screen%2BShot%2B2019-02-27%2Bat%2B6.59.33%2BPM.png" width="640" /></span></a></td></tr><tr><td class="tr-caption" style="text-align: center;"><span style="font-family: "times" , "times new roman" , serif; font-size: small;">wrong token</span></td></tr></tbody></table><div style="color: #212529; font-style: normal; letter-spacing: normal; text-transform: none; white-space: normal; word-spacing: 0px;"><span style="font-family: "times" , "times new roman" , serif;"><br /></span></div><table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="color: #212529; font-style: normal; letter-spacing: normal; margin-left: auto; margin-right: auto; text-align: center; text-transform: none; white-space: normal; word-spacing: 0px;"><tbody><tr><td style="text-align: center;"><a href="https://1.bp.blogspot.com/-nzUNm-8GkSg/XHclZTXfE7I/AAAAAAAACbI/WPi6xZNNxgkCABGTK05vxIw1aPgjQf2FwCLcBGAs/s1600/Screen%2BShot%2B2019-02-27%2Bat%2B6.59.48%2BPM.png" imageanchor="1" style="margin-left: auto; margin-right: auto;"><span style="font-family: "times" , "times new roman" , serif;"><img border="0" data-original-height="399" data-original-width="1600" height="156" src="https://1.bp.blogspot.com/-nzUNm-8GkSg/XHclZTXfE7I/AAAAAAAACbI/WPi6xZNNxgkCABGTK05vxIw1aPgjQf2FwCLcBGAs/s640/Screen%2BShot%2B2019-02-27%2Bat%2B6.59.48%2BPM.png" width="640" /></span></a></td></tr><tr><td class="tr-caption" style="text-align: center;"><span style="font-family: "times" , "times new roman" , serif; font-size: small;">correct token</span></td></tr></tbody></table></div></div><div style="color: #212529;"><style type="text/css">p.p1 {margin: 0.0px 0.0px 0.0px 0.0px; font: 13.0px Monaco; color: #f2f2f2; background-color: #000000} span.s1 {font-variant-ligatures: no-common-ligatures} </style></div></div>

First name:

Last name:

Related Posts