# Open prod Jenkins instance

Exposed Snapchat Jenkins instance allowed login with any Google account, granting API tokens, source code, and Groovy Script Console RCE.

- Payout: $15,000
- Severity: high
- Program: Snapchat
- Credited: preben
- Disclosed: 2017-08-19
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/231460
- Library page: https://bugbountylibrary.com/r/h1%3A231460
- Tags: domain:web impact:data-leak impact:internal-access impact:rce kind:bounty platform:hackerone sev:high tech:ci-cd technique:recon vuln:auth-bypass vuln:misconfiguration vuln:rce

**Target:** Jenkins CI instance on sc-corp.net subdomain
**Root cause:** Jenkins instance was internet-exposed and configured to accept authentication from any valid Google account rather than restricting to the organization, and authenticated users had Script Console access.
**Steps:**
1. Enumerate subdomains via Censys certificate SAN query: `443.https.tls.certificate.parsed.extensions.subject_alt_name.dns_names:sc-corp.net`
2. Find `REDACTED-jenkins-Environment.sc-corp.net` returning 302 to login
3. Brute-force permutations `REDACTED-jenkins-{dev,alpha,stage,prod,beta,local,test}.sc-corp.net`
4. Visit a non-prod instance and log in with any valid Gmail account via Google OAuth
5. Access Jenkins Script Console and run Groovy to read files / execute commands: `def proc = 'ls /etc/'.execute()`
6. Report immediately after confirming file read; include RCE script for impact
**How found:** Recon methodology: subdomain brute force, then Censys certificate SAN search on sc-corp.net to find non-brute-forceable subdomains; noticed a Jenkins login page and hypothesized other environment permutations existed, then tested login on each.
**Exploitation:** Attacker logs into the exposed Jenkins with any Google account, then uses the Groovy Script Console to read arbitrary files and execute OS commands on the Jenkins host, and accesses stored API tokens and source code of public apps.
**Escalation:** Jenkins host likely has access to production/internal servers and private keys, enabling pivoting; also GitHub OAuth plugin tokens could grant API access to org repos.
**Insight:** Certificate transparency SAN searches on corp/CDN domains reveal internal-pattern hostnames (e.g. jenkins-<env>) that brute force misses; then permute environment names and test OAuth login on each, since non-prod instances often accept any Google/GitHub account.