Aws CodebuildApplication · Jenkins

CVE-2018-1000404

HIGH · 7.8 CVSS v3.0 Published 2018-07-09

Fix available

A fix is available. Upgrade to after 0.26 or later.

See remediation →

80/100

Remediation priority · High

Zero-click

Official description

NVD · unedited

Jenkins project Jenkins AWS CodeBuild Plugin version 0.26 and earlier contains a Insufficiently Protected Credentials vulnerability in AWSClientFactory.java, CodeBuilder.java that can result in Credentials Disclosure. This attack appear to be exploitable via local file access. This vulnerability appears to have been fixed in 0.27 and later.

Technical summary

dbcve analysis · high confidence

The Jenkins AWS CodeBuild Plugin versions 0.26 and earlier stored AWS credentials insufficiently protected in AWSClientFactory.java and CodeBuilder.java, allowing local file access to read and disclose stored credentials.

MitigationUpgrade the Jenkins AWS CodeBuild Plugin to version 0.27 or later. If exploitation is suspected, rotate any AWS credentials that may have been exposed.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions

NVD · CPE data

Aws CodebuildApplication

Affected:<= 0.26

CVSS breakdown

From the vector

Attack vector: Local
Complexity: Low
Privileges: Low
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Am I affected?

dbcve checks

Work through these to decide whether this CVE applies to you.

Verify Jenkins AWS CodeBuild Plugin is installed

Navigate to Jenkins > Manage Jenkins > Manage Plugins > Installed, or inspect the plugin directory at $JENKINS_HOME/plugins/ for a folder starting with 'aws-codebuild'

Affected if The plugin folder exists in the Jenkins plugins directory
Check the installed plugin version

In Jenkins UI, go to Manage Jenkins > Manage Plugins > Installed, find AWS CodeBuild Plugin, and note the version. Alternatively, inspect the manifest file at $JENKINS_HOME/plugins/aws-codebuild/META-INF/MANIFEST.MF for the Plugin-Version attribute

Affected if The version is 0.26 or earlier
Identify credential storage location

Check for the presence of $JENKINS_HOME/credentials.xml and inspect the AWS CodeBuild plugin configuration at $JENKINS_HOME/org.jenkinsci.plugins.awscodebuild.AwsCodeBuildPlugin.xml if it exists

Affected if AWS credentials are stored in Jenkins credential store and associated with AWS CodeBuild plugin configurations
Inspect plugin source files for credential handling

If plugin files are accessible, examine AWSClientFactory.java and CodeBuilder.java in the plugin JAR or decompiled classes for insecure credential storage patterns

Affected if The source files show credentials being written to disk or stored in plaintext
Check file permissions on plugin and credential files

Run 'ls -la' on $JENKINS_HOME/plugins/ and $JENKINS_HOME/credentials.xml to verify permissions are not overly permissive (should not be world-readable)

Affected if Credentials.xml or plugin files are readable by unauthorized users

A user is affected if the Jenkins AWS CodeBuild Plugin version 0.26 or earlier is installed and AWS credentials are stored in Jenkins while the plugin or credential files have insufficient access controls.

Generated from the published advisory. Verify against your own configuration.

Remediation

From vendor data

Upgrade available Upgrade to a release after 0.26

Interim mitigation

Upgrade the Jenkins AWS CodeBuild Plugin to version 0.27 or later. If exploitation is suspected, rotate any AWS credentials that may have been exposed.

Fix this in Aws Codebuild Scoped from the published advisory

Consultation1.0 h
Implementation1.0 h
Testing1.0 h
Review / QA0.5 h

3.5 hours of engineering $750

Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $1,200.

Scan for this in your stack

Free · runs locally

dbcve dependency scanner

Check whether your project pulls in CVE-2018-1000404 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References

Primary sources

jenkins.ioVendor Advisory
nvd.nist.govNVD record

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2018-1000404 in production — separate from our analysis above.

Notes0 Guidelines

Know something about CVE-2018-1000404?

The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.

The version that genuinely resolved it — not the one the vendor claimed
A config change or rule that shut the vector down
A gotcha in the upgrade path that cost you an afternoon

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here

Verified mitigations, workarounds, and config changes
Version or environment caveats, and links to real fixes
No weaponised exploit code, or anything meant to cause harm
No spam, self-promotion, credentials, or personal data

At a glance

A fix existsUpgrade to after 0.26 or later

Severity 7.8 High

Exploit likelihood EPSS, next 30 days 0.3%

Affects: Aws Codebuild

Remediation

A high-priority fix

Fix this in Aws Codebuild 4 hrs · Low

Typical engagement from $750

Get a fix See the full breakdown ↓

A high-priority vulnerability. Send your environment and a specialist will scope CVE-2018-1000404 and return a fixed quote and timeline.

You’ll deal with our team directly and deploy the reviewed fix to staging first — never straight to production.

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

Check your environment

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

Scan for this in your stack

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Practitioner notes

No notes yet

Official description

Technical summary

Affected products & versions

CVSS breakdown

Am I affected?

Remediation

References