CVE-2020-2146
📋 TL;DR
The Jenkins Mac Plugin 1.1.0 and earlier fails to validate SSH host keys when connecting to agents, allowing man-in-the-middle attackers to intercept and potentially manipulate communications between Jenkins and its agents. This affects Jenkins administrators using the Mac Plugin to manage macOS agents.
💻 Affected Systems
- Jenkins Mac Plugin
📦 What is this software?
Mac by Jenkins
⚠️ Risk & Real-World Impact
Worst Case
Attackers could intercept sensitive data (credentials, build artifacts, source code), inject malicious commands into build pipelines, or gain persistent access to Jenkins infrastructure.
Likely Case
Attackers on the same network could intercept agent communications, potentially stealing credentials or manipulating build processes.
If Mitigated
With proper network segmentation and monitoring, impact is limited to potential data leakage from intercepted communications.
🎯 Exploit Status
Exploitation requires network access between Jenkins and agents, but the attack itself is straightforward once positioned.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Jenkins Mac Plugin 1.1.1
Vendor Advisory: https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1692
Restart Required: Yes
Instructions:
1. Update Jenkins Mac Plugin to version 1.1.1 or later via Jenkins Plugin Manager. 2. Restart Jenkins. 3. Verify plugin version in Manage Jenkins > Manage Plugins.
🔧 Temporary Workarounds
Disable Mac Plugin
allTemporarily disable the vulnerable plugin if immediate patching isn't possible.
java -jar jenkins-cli.jar -s http://jenkins-url/ disable-plugin mac
Use alternative agent connection methods
allConfigure macOS agents using JNLP or other connection methods instead of SSH through the Mac Plugin.
🧯 If You Can't Patch
- Segment network to isolate Jenkins and agent communications from untrusted networks
- Implement certificate-based SSH authentication with strict host key checking outside the plugin
🔍 How to Verify
Check if Vulnerable:
Check Jenkins plugin manager for Mac Plugin version. If version is 1.1.0 or earlier and plugin is enabled, system is vulnerable.Check Version:
Check Jenkins web UI at Manage Jenkins > Manage Plugins > Installed tab, or examine $JENKINS_HOME/plugins/mac/META-INF/MANIFEST.MFVerify Fix Applied:
Verify Mac Plugin version is 1.1.1 or later in Manage Jenkins > Manage Plugins > Installed tab.📡 Detection & Monitoring
Log Indicators:
- Failed SSH host key validation attempts
- Unexpected SSH connection patterns to agents
- Jenkins agent connection failures
Network Indicators:
- Unusual SSH traffic patterns between Jenkins and macOS agents
- SSH man-in-the-middle detection alerts
SIEM Query:
source="jenkins.log" AND ("mac plugin" OR "SSH host key") AND ("failed" OR "error" OR "warning")