CVE-2018-1000600

Think of Jenkins as a “control room” that stores credentials to talk to GitHub. This bug in older versions of the GitHub plugin can trick Jenkins into handing those stored credentials to an attacker’s chosen destination, like sending a key to your front door to the wrong address.

This matters if your business runs Jenkins and has the GitHub plugin (com.coravy.hudson.plugins.github:github) installed at version 1.29.1 or earlier. The risk exists when someone can reach the vulnerable behavior in Jenkins (for example, by interacting with Jenkins in a way that triggers the plugin’s credential-handling path). It’s not a concern if you don’t run the plugin or you’re already on the fixed version.

Treat this as urgent enough to schedule immediately because the vulnerability is aimed at stealing sensitive credentials and the plugin has a straightforward fix. Public interest is rising, and the predicted likelihood of abuse is high—so upgrade to the fixed plugin version right away rather than waiting for the next patch window.

Confirm exposure

• In Jenkins, open Manage Plugins and find GitHub (com.coravy.hudson.plugins.github:github).
• Record the installed version. If it is 1.29.1 or earlier, you are exposed.

Upgrade to the fixed version

• Upgrade com.coravy.hudson.plugins.github:github to 1.29.2 (this is the version noted as fixed in the Jenkins advisory).
• After upgrading, verify the plugin shows 1.29.2 (or higher, if your environment later updated beyond that).

Credential handling after upgrade

• If Jenkins stores GitHub credentials used by this plugin, rotate those credentials after the upgrade. This reduces the impact if credentials were ever exposed.

Temporary containment if patching is delayed

• Restrict who can interact with Jenkins features that could trigger the vulnerable credential-handling behavior, and reduce exposure of Jenkins to the internet where possible.
• Monitor for unusual outbound connections from the Jenkins host to destinations you don’t normally use.

What to monitor

• Jenkins logs around plugin activity for errors or odd credential-related events.
• Outbound network connections from the Jenkins server for destinations that don’t match your normal GitHub/CI workflow.

Timing note

• This issue is fixed in 1.29.2; patching is the primary remediation.

CVE-2018-1000600 (CWE-200) is an information exposure issue in Jenkins GitHub Plugin versions 1.29.1 and earlier. The mechanism involves the GitHubTokenCredentialsCreator code path exposing sensitive credentials by directing them to an attacker-controlled URL (using attacker-influenced credentials IDs obtained via another method).

Findings indicate a remediation version: com.coravy.hudson.plugins.github:github fixed in 1.29.2 (per Jenkins advisory https://jenkins.io/security/advisory/2018-06-25/#SECURITY-915). KEV does not list this issue, and exploit/weaponization details are not provided beyond detection-template presence; however, predicted likelihood is reported as very high and press attention is rising. The practical risk for an organization is credential theft leading to GitHub account or repository compromise, depending on what tokens/credentials are stored and what access they grant.