Pre-auth User Information Leakage
While testing Jenkins, it’s a common scenario that you want to perform a brute-force attack but you don’t know which account you can try(a valid credential can read the source at least so it’s worth to be the first attempt).
In this situation, this vulnerability is useful!Due to the lack of permission check on search functionality. By modifying thekeyword
from a to z, an attacker can list all users on Jenkins!
http://jenkins.local/securityRealm/user/admin/search/index?q=[keyword]
/securityRealm/user/admin/search/index?q=a |
/securityRealm/user/admin/search/index?q=c
ALERT
Even though the advisory says 2.138_1 i tested against 2.138 and the exploit doesn't work. SOOOOO you are looking for Jenkins <= 2.137 If jenkins is really old the above should work and also https://nvd.nist.gov/vuln/detail/CVE-2017-1000395 where you can get the email address via similar query. |
http://jenkins.local/securityRealm/user/admin/api/xml
with 2.137 you can get username/id/securityRealm/user/cg/api/xml |
Click to Open Code Editor