Miggo Logo
Miggo Vulnerability Database
→
CVE-2017-1000354

CVE-2017-1000354: Improper Authentication in Jenkins

8.8

CVSS Score
3.0

Basic Information

CVE ID
CVE-2017-1000354
GHSA ID
GHSA-r57f-7xw3-q2r9
EPSS Score
0.58654%
CWE
CWE-287
Published
5/14/2022
Updated
4/19/2024
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.jenkins-ci.main:jenkins-coremaven>= 2.50, <= 2.562.57
org.jenkins-ci.main:jenkins-coremaven<= 2.46.12.46.2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stemmed from how authentication data was stored and validated. The pre-patch implementation in ClientAuthenticationCache:

  1. get() blindly trusted the stored encrypted username without MAC validation
  2. set() persisted only the encrypted username without a cryptographic integrity check
  3. The lack of HMAC allowed substitution attacks when combined with secret decryption capabilities
  4. The test case in ClientAuthenticationCacheTest.java demonstrates how modifying the stored value could bypass authentication
  5. The fix introduced HMACConfidentialKey to bind the username to a MAC, making tampering detectable

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

J*nkins v*rsions *.** *n* **rli*r *s w*ll *s *.**.* LTS *n* **rli*r *r* vuln*r**l* to * lo*in *omm*n* w*i** *llow** imp*rson*tin* *ny J*nkins us*r. T** `lo*in` *omm*n* *v*il**l* in t** r*motin*-**s** *LI stor** t** *n*rypt** us*r n*m* o* t** su***ss*

Reasoning

T** vuln*r**ility st*mm** *rom *ow *ut**nti**tion **t* w*s stor** *n* v*li**t**. T** pr*-p*t** impl*m*nt*tion in *li*nt*ut**nti**tion*****: *. **t() *lin*ly trust** t** stor** *n*rypt** us*rn*m* wit*out M** v*li**tion *. s*t() p*rsist** only t** *n*r