CVE-2020-2114
📋 TL;DR
The Jenkins S3 publisher Plugin versions 0.11.4 and earlier transmit AWS credentials in plain text within the global Jenkins configuration form. This allows attackers with access to Jenkins configuration pages to steal AWS credentials, potentially leading to unauthorized access to S3 buckets. Organizations using vulnerable versions of this plugin are affected.
💻 Affected Systems
- Jenkins S3 publisher Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain AWS credentials, access sensitive S3 data, modify or delete critical files, and potentially pivot to other AWS resources.
Likely Case
Internal or external attackers capture AWS credentials and access S3 buckets containing sensitive data like backups, logs, or application artifacts.
If Mitigated
With proper network segmentation and access controls, credential exposure is limited to authorized Jenkins administrators only.
🎯 Exploit Status
Exploitation requires access to Jenkins configuration pages, typically requiring at least some level of Jenkins user permissions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.11.5
Vendor Advisory: https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1684
Restart Required: Yes
Instructions:
1. Update Jenkins S3 publisher Plugin to version 0.11.5 or later via Jenkins Plugin Manager. 2. Restart Jenkins. 3. Verify the plugin version in Manage Jenkins > Manage Plugins > Installed tab.
🔧 Temporary Workarounds
Remove AWS credentials from plugin configuration
allTemporarily remove AWS credentials from the S3 publisher plugin configuration to prevent exposure.
Navigate to Manage Jenkins > Configure System > S3 Profiles section and remove or obfuscate credentials
Restrict access to Jenkins configuration
allLimit user permissions to only necessary personnel using Jenkins Role-Based Access Control.
Configure permissions via Manage Jenkins > Manage and Assign Roles
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Jenkins from the internet and limit internal access.
- Use AWS IAM roles instead of static credentials where possible, and rotate any exposed credentials immediately.
🔍 How to Verify
Check if Vulnerable:
Check installed plugin version via Manage Jenkins > Manage Plugins > Installed tab, look for S3 publisher plugin version 0.11.4 or earlier.Check Version:
Check Jenkins plugin directory or use Jenkins CLI: java -jar jenkins-cli.jar -s http://jenkins-url/ list-plugins | grep s3Verify Fix Applied:
Verify plugin version is 0.11.5 or later in Manage Jenkins > Manage Plugins > Installed tab, and confirm credentials are no longer visible in plain text in configuration forms.📡 Detection & Monitoring
Log Indicators:
- Unusual access to Jenkins configuration pages, especially from unauthorized IPs or users
Network Indicators:
- Traffic to Jenkins configuration endpoints containing base64-encoded credentials in plain text
SIEM Query:
source="jenkins.log" AND ("Configure System" OR "S3 Profiles") AND (user NOT IN ["admin", "authorized_users"])