🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://www.nccgroup.com/research-blog/story-of-a-hundred-vulnerable-jenkins-plugins/
• Blog Title: Story of a hundred vulnerable Jenkins plugins
• Suggested Section: Network Services Pentesting -> Pentesting Web -> Jira & Confluence/Jenkins-related area (create/extend a Jenkins page) OR Pentesting Web -> CSRF & SSRF subsections with a dedicated "Jenkins plugins: FormValidation/TestConnection SSRF+CSRF" section; additionally reference in Windows/Linux post-exploitation for "Jenkins secrets on disk" (paths and search patterns).

🎯 Content Summary

NCC Group (Viktor Gazdag) manually tested hundreds of Jenkins plugins and identified 100+ vulnerable plugins, leading to coordinated responsible disclosures (02 May 2019). The post focuses on two recurring vulnerability classes and shows concrete, low-level evidence (filesystem artifacts, HTTP requests, error output) plus remediation patterns:
1) credentials stored in plaintext (or exposed in the UI due to incorrect Jelly controls), and
2) CSRF + missing permission checks on “test connec...

🔧 Technical Details

Plaintext Jenkins plugin/job secret storage discovery: Don’t assume Jenkins secrets are only in credentials.xml. Many plugins persist secrets in their own global XML under /var/lib/jenkins/*.xml or in per-job /var/lib/jenkins/jobs/<JOB>/config.xml. If filesystem read access is possible, enumerate and inspect these files (e.g., ls -l, cat) and search for obvious secret tags (example shown: <awsSecretKey>) because UI masking does not prevent plaintext persistence.

Correct Jenkins secret handling pattern (developer-side hardening): Replace raw String secret fields with hudson.util.Secret (or use the Credentials Plugin). Persist encrypted values using Secret.getEncryptedValue(...) and read them back with Secret.decrypt(...). Ensure the DataBoundConstructor round-trips encrypted values so secrets are not re-exposed ...

🤖 Agent Actions

Summary:

• Added a dedicated Jenkins pentesting page detailing filesystem secret hunting (plugin/global/job configs), exploitation of FormValidation/TestConnection endpoints for CSRF-driven credential theft and SSRF, and developer-side hardening patterns (POST enforcement, permission checks, Secret API).
• Updated the web tech tricks index to link to the new Jenkins page.

Files Modified:

• src/network-services-pentesting/pentesting-web/jenkins.md
• src/network-services-pentesting/pentesting-web/README.md

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

📚 Repository Maintenance

• MD files processed: 937
• MD files fixed: 1

All .md files have been checked for proper formatting (headers, includes, etc.).