Skip to content

Latest commit

 

History

History
82 lines (64 loc) · 7.04 KB

attack-tree.md

File metadata and controls

82 lines (64 loc) · 7.04 KB

Attack Tree Analysis for jenkinsci/job-dsl-plugin

Objective: Execute Arbitrary Code on Jenkins Master (SYSTEM Privileges) [CRITICAL]

Attack Tree Visualization

Execute Arbitrary Code on Jenkins Master (SYSTEM Privileges) [CRITICAL] | ----------------------------------------------------------------- | | Exploit Job DSL Plugin Vulnerabilities Abuse Legitimate Job DSL Features | |

| | | | |

  1. Script Security 2. Unsafe Groovy 4. Seed Job 5. External 6. Misconfigured Vulnerabilities Processing Manipulation Job Abuse Permissions | | | | |

| | | | | | | 1a. 1b. 2a. 2c. 4a. 4b. 5a. 5b. 6a. Bypass Inject Unsafe Use Create Modify Read Use No Sandbox Groovy Methods @Grab Malicious Malicious External Scripts Sand- [CRITICAL] in DSL (e.g., (e.g., Seed Seed Jobs boxing Scripts Runtime. resolveClass) Job Job [CRITICAL] [CRITICAL] exec) [CRITICAL] [CRITICAL] [CRITICAL]

Attack Tree Path: 1. Script Security Vulnerabilities

  • 1a. Bypass Sandbox [CRITICAL]

    • Description: Circumvent the Groovy sandbox restrictions to execute arbitrary code with the privileges of the Jenkins service account.
    • Techniques: Exploiting vulnerabilities in the sandbox implementation, using reflection to access restricted classes or methods, leveraging known sandbox escape sequences.
    • Mitigation: Regularly update the Script Security Plugin and Jenkins core. Thoroughly review and test the sandbox configuration. Perform penetration testing focused on sandbox escapes.

  • 1b. Inject Groovy in DSL Scripts [CRITICAL]

    • Description: Insert malicious Groovy code into a DSL script, which is then executed by the Jenkins master.
    • Techniques: Exploiting input validation flaws in seed jobs, external jobs, or other input fields that accept DSL script content. Compromising an SCM repository containing DSL scripts.
    • Mitigation: Implement strict input validation and sanitization for all sources of DSL script content. Use parameterized builds with strong typing to limit the scope of user input. Regularly scan SCM repositories for malicious code.

Attack Tree Path: 2. Unsafe Groovy Processing

  • 2a. Unsafe Methods (e.g., Runtime.exec) [CRITICAL]

    • Description: The Job DSL Plugin (or a dependency) uses inherently unsafe Groovy methods like Runtime.exec() without proper sanitization, allowing an attacker to execute arbitrary shell commands.
    • Techniques: Injecting shell commands into parameters passed to Runtime.exec() or similar methods.
    • Mitigation: Avoid using Runtime.exec() and similar methods whenever possible. If their use is unavoidable, implement rigorous input validation and sanitization, ideally using a whitelist approach. Consider using safer alternatives for executing external processes.

  • 2c. Use @Grab (e.g., resolveClass)

    • Description: The @Grab annotation is used to dynamically resolve dependencies. If an attacker can control the parameters of @Grab, they can force the plugin to load a malicious library. resolveClass can be used to load arbitrary classes.
    • Techniques: Injecting malicious @Grab coordinates into a DSL script or configuration.
    • Mitigation: Restrict the use of @Grab to trusted sources and repositories. Validate and sanitize any user-provided input that influences @Grab parameters. Consider using a fixed set of allowed dependencies.

Attack Tree Path: 4. Seed Job Manipulation

  • 4a. Create Malicious Seed Job [CRITICAL]

    • Description: An attacker gains the ability to create a new seed job, allowing them to define arbitrary job configurations, including those that execute malicious code.
    • Techniques: Exploiting authentication or authorization vulnerabilities to gain access to the Jenkins UI or API with sufficient privileges to create seed jobs.
    • Mitigation: Implement strong authentication and authorization controls. Restrict the ability to create seed jobs to a limited set of trusted administrators. Use multi-factor authentication.

  • 4b. Modify Malicious Seed Job [CRITICAL]

    • Description: An attacker gains the ability to modify an existing seed job, allowing them to inject malicious code or configurations.
    • Techniques: Exploiting authentication or authorization vulnerabilities to gain access to the Jenkins UI or API with sufficient privileges to modify seed jobs.
    • Mitigation: Implement strong authentication and authorization controls. Restrict the ability to modify seed jobs to a limited set of trusted administrators. Use multi-factor authentication. Implement change management and auditing for seed job configurations.

Attack Tree Path: 5. External Job Abuse

  • 5a. Read External Jobs

    • Description: The Job DSL Plugin reads job definitions from an untrusted external source (e.g., a compromised SCM repository), and an attacker injects malicious code into those definitions.
    • Techniques: Compromising an SCM repository, Man-in-the-Middle (MitM) attack on the connection to the external source.
    • Mitigation: Use secure protocols (e.g., HTTPS) for communication with external sources. Verify the integrity of data fetched from external sources (e.g., using checksums or digital signatures). Implement strong access controls on SCM repositories.

  • 5b. Use External Scripts

    • Description: The Job DSL Plugin executes scripts from an untrusted external source, and an attacker injects malicious code into those scripts.
    • Techniques: Compromising an SCM repository, Man-in-the-Middle (MitM) attack on the connection to the external source.
    • Mitigation: Avoid executing scripts from untrusted sources. If necessary, thoroughly vet and sanitize external scripts before execution. Use secure protocols (e.g., HTTPS) for communication with external sources.

Attack Tree Path: 6. Misconfigured Permissions

  • 6a. No Sandboxing [CRITICAL]
    • Description: The Groovy sandbox is disabled, allowing DSL scripts to execute with the full privileges of the Jenkins service account.
    • Techniques: Directly modifying the Jenkins configuration to disable the sandbox.
    • Mitigation: Ensure the Groovy sandbox is enabled. Regularly review the Jenkins configuration for security misconfigurations. Use a configuration management tool to enforce secure settings.