Jenkins notes for:
to download old jenkins WAR files
1st bug in the blog is a username enumeration bug in
- Jenkins weekly up to and including 2.145
- Jenkins LTS up to and including 2.138.1
Pre-auth User Information Leakage
While testing Jenkins, it’s a common scenario that you want to perform a brute-force attack but you don’t know which account you can try(a valid credential can read the source at least so it’s worth to be the first attempt).
In this situation, this vulnerability is useful!Due to the lack of permission check on search functionality. By modifying the
keywordfrom a to z, an attacker can list all users on Jenkins!
Even though the advisory says 2.138_1 i tested against 2.138 and the exploit doesn’t work.
SOOOOO you are looking for Jenkins <= 2.137
If jenkins is really old the above should work and also https://nvd.nist.gov/vuln/detail/CVE-2017-1000395 where you can get the email address via similar query.
- versions up to (including) 2.73.1
- versions up to (including) 2.83
with 2.137 you can get username/id
*** This is a Security Bloggers Network syndicated blog from Carnal0wnage & Attack Research Blog authored by CG. Read the original post at: http://carnal0wnage.attackresearch.com/2019/02/jenkins-messing-with-new-exploits-pt1.html