CVE-2019-1003043

Vulnerability

A missing permission check in the Jenkins Slack Notification Plugin versions 2.19 and earlier [1][2][3] allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins [3]. The vulnerability exists in a form validation method that did not perform permission checks [3].

Exploitation

An attacker must have Overall/Read access to the Jenkins instance [2][3]. The attacker first obtains credentials IDs through another method (e.g., other vulnerabilities or information disclosure). Then the attacker crafts a request to the vulnerable form validation endpoint, specifying a URL under their control and the stolen credentials IDs [3]. The plugin will then connect to the attacker's URL using those credentials, effectively sending the credential values (e.g., secret text tokens) to the attacker [3]. Additionally, this form validation method did not require POST requests, making exploitation easier via CSRF (CVE-2019-1003044) if the attacker also tricks an admin into visiting a malicious link [3].

Impact

Successful exploitation allows an attacker to capture Jenkins credentials that are stored as secret text or similar, potentially gaining access to Slack workspaces, other services, or escalating privileges within Jenkins [2][3]. The attacker obtains the plaintext credentials from the attacker-specified URL [3].

Mitigation

Jenkins released Slack Notification Plugin version 2.20 (included in the 2019-03-25 security advisory) which adds proper permission checks and CSRF protection [3]. Users should upgrade to version 2.20 or later. No workaround other than upgrading is mentioned in the references. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog as of the publication date.