Exposed Jenkins Instance Enabled Access to Servers, Credentials, and Production Data
Summary
CloudSEK reported that an unauthenticated Jenkins instance exposed multiple servers, credentials, and a production database containing customer and employee PII. The organization isolated servers, revoked exposed credentials, and strengthened access controls.
Key points
- An internet-accessible Jenkins service lacked authentication and enabled remote code execution.
- Access to Jenkins exposed production and UAT deployment servers across PHP, React, and Java environments.
- Researchers found AWS keys, Redis credentials, BitBucket tokens, and Jenkins secrets in the exposed infrastructure.
- The exposed credentials enabled access to a production database containing customer and employee personally identifiable information.
- The organization isolated affected servers, rotated credentials, and enforced MFA and least-privilege access.
Article Details
- Victim Organization
- Not disclosed
- Incident Type
- Exposure of an unauthenticated Jenkins instance enabled unauthorized access, remote code execution, and compromise of associated servers and a production database.
- Data Types Exposed
- Customer and employee personally identifiable information (PII), including addresses and location coordinates
- AWS access keys
- Redis credentials
- BitBucket authentication tokens and cryptographic keys
- API tokens and security keys
- Operational Impact
- Attackers could execute commands, escalate privileges across five servers, manipulate builds and deployments, access production and UAT environments, and access a production database. The organization isolated compromised servers and rotated exposed credentials.
- Claim Status
- confirmed
Products
AWSCredential Theft: AWS keys, Redis credentials, BitBucket cryptographic keys, and authentication secrets were all available for exploitation.BitbucketCredential Theft: AWS keys, Redis credentials, BitBucket cryptographic keys, and authentication secrets were all available for exploitation.JenkinsOne such case involved an exposed Jenkins instance, which, if left unchecked, could have led to devastating consequences.RedisCredential Theft: AWS keys, Redis credentials, BitBucket cryptographic keys, and authentication secrets were all available for exploitation.