Parsing Jenkins Configuration Files for Forensics and Fun

December 12, 2024 5 mins

Parsing Jenkins Configuration Files for Forensics and Fun

A new parsing tool for Jenkins® configuration files from Stroz Friedberg Digital Forensics and Incident Response enables efficient forensic examination during investigations.

If you've kept up with Jenkins security advisories over the past few years, you'll know that threat actors often find and exploit vulnerabilities in Jenkins servers. Jenkins is widely used for continuous integration and continuous delivery ("CI/CD") pipelines. According to the Continuous Delivery Foundations Jenkins project, Jenkins saw a 79% increase in total workloads per month between June 2021 and June 2023, reaching over 48 million jobs per month. A quick search for Jenkins servers on Shodan® reveals over 53 thousand systems.

In a forensic investigation involving a Jenkins server, it's imperative that analysts have tools at their disposal to threat hunt and evaluate any suspicious activity on the system. On a Jenkins server, suspicious activity can mean any jobs created or triggered by suspicious users or vulnerable plugins installed on the server. Misconfigured Jenkins servers can allow even unauthenticated users to run arbitrary code on the system.

To aid investigators in cases involving Jenkins servers, Stroz Friedberg Digital Forensics and Incident Response has released a Python script that processes job and plugin configuration and compiles some of the most important attributes into a CSV file. The script extracts the following fields from the build and job configuration files:

Field	Description
config_modified_time	Modified time of the config.xml file associated with the build
build_modified_time	Modified time of the build.xml file associated with the build
build_start_time	Start time of the build
keep_log	Boolean that indicates whether the server retained the log associated with the build
username	User associated with the build
build_number	Build number
result	Result status of the build
job_name	Name of the job associated with the build
config_description	Description of the job associated with the build

and the following fields from the plugin configuration files:

Field	Description
name	Friendly name of the plugin
version	Version of the plugin
url	URL associated with the plugin

The script takes the path to $JENKINS_HOME as input. It assumes that all timestamps are preserved from the original system, since it will use the file's modified timestamps to populate config_modified_time and build_modified_time.

The script is available on GitHub. We welcome issues and feature requests.

Jenkins® is a registered trademark of LF Charities Inc.
Shodan® is a registered trademark of Shodan.

Building — Support

Contact our cyber response teams for urgent breach assistance.

Contact Us

Author

Julia Paluch

Solutions Development

Cyber security services are offered by Stroz Friedberg Inc., its subsidiaries and affiliates. Stroz Friedberg is part of Aon’s Cyber Solutions which offers holistic cyber risk management, unsurpassed investigative skills, and proprietary technologies to help clients uncover and quantify cyber risks, protect critical assets, and recover from cyber incidents.

This document is not intended to address any specific situation or to provide legal, regulatory, financial, or other advice. While care has been taken in the production of this document, Aon does not warrant, represent or guarantee the accuracy, adequacy, completeness or fitness for any purpose of the document or any part of it and can accept no liability for any loss incurred in any way by any person who may rely on it. Any recipient shall be responsible for the use to which it puts this document. This document has been compiled using information available to us up to its date of publication and is subject to any qualifications made in the document. While care has been taken in the preparation of this material and some of the information contained within it has been obtained from sources that Stroz Friedberg believes to be reliable (including third-party sources), Stroz Friedberg does not warrant, represent, or guarantee the accuracy, adequacy, completeness or fitness for any purpose of the article and accepts no liability for any loss incurred in any way whatsoever by any person or organization who may rely upon it. It is for informational purposes only. You should consult with your own professional advisors or IT specialists before implementing any recommendation or following the guidance provided herein. Further, we endeavor to provide accurate and timely information, there can be no guarantee that such information is accurate as of the date it is received or that it will continue to be accurate in the future. Further, this article has been compiled using information available to us up to 12/12/2024.

The contents herein may not be reproduced, reused, reprinted or redistributed without the expressed written consent of Aon, unless otherwise authorized by Aon. To use information contained herein, please write to our team.