PT-2021-14668 · Amazon+2 · Aws Parameter Store Build Wrapper+4
Daniel Beck
·
Published
2021-03-18
·
Updated
2023-10-25
·
CVE-2021-21625
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Jenkins CloudBees AWS Credentials Plugin versions 1.28 and earlier
Description
The issue allows attackers with Overall/Read permission to enumerate credentials IDs of AWS credentials stored in Jenkins under certain circumstances. This can occur when specific plugins are installed, such as the Amazon Elastic Container Service (ECS) / Fargate, AWS Parameter Store Build Wrapper, or AWS SAM plugins. The enumerated credentials IDs can be used as part of an attack to capture the credentials using another vulnerability.
Recommendations
For Jenkins CloudBees AWS Credentials Plugin versions 1.28 and earlier, update to version 1.28.1 or later, which performs permission checks in the helper method for HTTP endpoints. As a temporary workaround, consider restricting access to the helper method for HTTP endpoints until the update can be applied. Additionally, review the installation of plugins that may use this helper method without performing a permission check themselves, such as the Amazon Elastic Container Service (ECS) / Fargate, AWS Parameter Store Build Wrapper, or AWS SAM plugins, and ensure they are updated or configured to mitigate the risk.
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Aws Parameter Store Build Wrapper
Aws Sam
Amazon Elastic Container Service (Ecs) / Fargate
Jenkins
Jenkins Cloudbees Aws Credentials Plugin