Source: portswigger.net (original reporting). This article is based on that reporting and publicly available information about Jenkins security posture.
Overview
Network security testing firm Dolos Group released a free, open-source tool called Jenkins-Pillage that automates the extraction of sensitive data from exposed Jenkins servers. The tool is aimed at penetration testers and security researchers, but its existence highlights a serious and recurring problem: Jenkins servers that are misconfigured or left unauthenticated can leak credentials, private keys, environment variables, and source code repositories to anyone who knows where to look.
What Is Jenkins-Pillage?
Jenkins-Pillage is a command-line tool published on GitHub by Dolos Group. Its purpose is to automate what has historically been a multi-step, manual reconnaissance process during a penetration test against a Jenkins instance.
According to the tool’s GitHub description:
“This tool will attempt to pull console output, environment variables, and workspaces associated with Jenkins builds. It works both against unauthenticated and authenticated (with creds) servers.”
Dolos Group, GitHub
In a single automated pass, Jenkins-Pillage can collect:
- Console output — the stdout of build commands and scripts, which often includes database connection strings, API calls with embedded tokens, and other sensitive runtime information.
- Environment variables — frequently used to pass secrets such as passwords, API keys, and cloud provider credentials into build pipelines.
- Workspace contents — the files checked out and generated during a build, potentially including source code, configuration files, and private keys.
Why Jenkins Servers Are a High-Value Target
Jenkins is one of the most widely deployed open-source CI/CD automation servers in the world. It sits at the center of software delivery pipelines, integrating with version control systems, cloud providers, container registries, and deployment targets — which means it regularly handles secrets that have access to large portions of an organization’s infrastructure.
Dolos Group describes the risk plainly in their blog post:
“Jenkins tends to be a treasure trove of information in certain organizations, and it’s all too easy for a developer or operations team to leave something behind ‘just to get things done’.”
Dolos Group
The problem is compounded by two common failure modes:
- Unauthenticated access — Jenkins installations that are publicly reachable without requiring a login, either intentionally (for convenience) or through misconfiguration.
- Unpatched vulnerabilities — Jenkins has historically been affected by critical vulnerabilities, including those that enable remote code execution (RCE). Slow patching cycles leave many production instances exposed for extended periods.
Misconfigured Jenkins servers have previously been exploited at scale in cryptomining campaigns that took advantage of known, unpatched vulnerabilities.
What Attackers (and Pen Testers) Can Extract
During a typical build, Jenkins may process and store far more sensitive data than teams realize. Some concrete examples of what can end up in build artifacts, console logs, or environment variables:
- Cloud provider credentials (AWS access keys, GCP service account keys)
- Database passwords passed as environment variables
- SSH private keys used to deploy to production servers
- Container registry credentials
- Source code from private repositories
- Internal hostnames, IP addresses, and network topology details
The manual process of retrieving this data through the Jenkins web UI — navigating build histories, expanding console logs, downloading workspaces — is slow and error-prone. Jenkins-Pillage eliminates that friction, making bulk data collection fast and repeatable.
Defensive Recommendations for DevOps Teams
The release of Jenkins-Pillage is a reminder that the barrier to exploiting a misconfigured Jenkins server is now very low. DevOps and platform engineering teams should treat Jenkins hardening as a baseline security requirement, not an afterthought.
Access Control
- Enable authentication on all Jenkins instances, including internal or “dev” servers — these often have the same secrets as production.
- Use the Role-Based Access Control (RBAC) plugin to apply least-privilege permissions. Not every user needs to read build logs or workspace files.
- Never expose the Jenkins UI directly to the public internet without a VPN or strong authentication layer in front of it.
Secret Management
- Use Jenkins’ built-in Credentials Store or integrate with a dedicated secrets manager (HashiCorp Vault, AWS Secrets Manager, etc.) rather than storing secrets as plain-text environment variables or in pipeline scripts.
- Mask sensitive values in console output using the Mask Passwords plugin or equivalent.
- Audit existing pipelines and build configurations for hardcoded credentials.
Patching and Hardening
- Keep Jenkins core and all plugins up to date. Subscribe to the Jenkins Security Advisories mailing list.
- Review the Jenkins security hardening documentation for guidance on disabling unnecessary features and agents.
- Disable the Jenkins CLI over remoting if it is not required.
- Restrict which users and build agents can read environment variables or access workspaces.
Workspace and Artifact Hygiene
- Configure Jenkins to clean workspaces after builds complete, especially for jobs that handle credentials or sensitive source code.
- Do not store unencrypted secrets in build artifacts or archive them unnecessarily.
For Penetration Testers
Dolos Group recommends that pen testers actively probe Jenkins instances discovered during assessments:
“If you come across a Jenkins server during a pen test, we highly recommend taking a look at the accessible internals.”
Dolos Group
Jenkins-Pillage is available for free on GitHub. As with all security tools, use it only against systems you are authorized to test.
Key Takeaway
An unauthenticated or misconfigured Jenkins server is not just a CI/CD problem — it is a potential breach of your entire infrastructure. Tools like Jenkins-Pillage demonstrate how quickly a motivated attacker (or a pen tester doing their job) can drain sensitive data from a poorly secured build server. Locking down Jenkins should be a non-negotiable part of any organization’s security baseline.