{"id":30380,"date":"2015-12-04T17:18:34","date_gmt":"2015-12-04T11:48:34","guid":{"rendered":"https:\/\/tothenewco.pro\/blog\/?p=30380"},"modified":"2015-12-07T15:43:54","modified_gmt":"2015-12-07T10:13:54","slug":"why-compromised-jenkins-can-lead-to-a-disaster","status":"publish","type":"post","link":"https:\/\/tothenewco.pro\/blog\/why-compromised-jenkins-can-lead-to-a-disaster\/","title":{"rendered":"Why compromised Jenkins can lead to a disaster?"},"content":{"rendered":"<p>I was recently searching for something on Google and came across this instance of what might be a <a title=\"Vulnerability Testing Services\" href=\"https:\/\/tothenewco.pro\/testing\/automated-independent-manual-testing\">logical vulnerability<\/a> prevailing across multiple web applications. I was searching for publicly accessible Jenkins console through Google Dorking. My search query\u00a0listed some of the websites that had Jenkins as a part of their domain name.\u00a0Although this itself is not a security issue but it reveals the fact that Jenkins is being used as a CI (Continous Integration) tool and it&#8217;s console is publicly accessible. The following information may be used to plan a chain of attacks.<br \/>\n<img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-30433\" src=\"\/blog\/wp-ttn-blog\/uploads\/2015\/12\/jenkins-main.png\" alt=\"jenkins main\" width=\"1365\" height=\"721\" \/><\/p>\n<p>What took me by surprise is that I found many Jenkins console with no authentication mechanism enabled on them. I can easily open the console, read the usernames, the build history, logs of builds and much more. This made me think about the necessity of having proper security implemented on a Jenkins console. So, this blog post will be covering the devastating effect of a compromised Jenkins server and how to protect this from happening.<\/p>\n<h3><span style=\"color: #ff6600;\">Why compromised Jenkins can lead to a disaster?<\/span><\/h3>\n<ul>\n<li>Treasure of credentials such as AWS Access keys and Secret key.<br \/>\nImpact: Anyone can use the AWS account linked to the Access keys and Secret keys to launch resources which will lead to the owner getting billed for it. A person possessing these\u00a0credentials gets full access to the AWS account<\/li>\n<li>The server&#8217;s pem files, IP addresses, usernames, email address etc.<br \/>\nImpact: The disclosure of the above mentioned information will lead to logging into the server (remember there may be a hundred of servers accessible from this console), running arbitrary commands on it, getting access to users and their respective password ( and what not! ).<br \/>\nThe revealed username and email address will also enable the attacker to plan much more sophisticated attacks on\u00a0the organization as he is now much more aware of the developer and other accounts that are present. This can also result in him brute forcing other applications such as the Admin, CMS portal of the application.<\/li>\n<li>GitHub SSH Key<br \/>\nSSH keys are used to identify trusted computers, without involving passwords. Since, Jenkins has availability of Git plugin which enables us to run Git commands from the Jenkins console itself. So, the publicly accessible Jenkins console will enable an attacker to view, modify, update the code of the production application. In the worst scenario possible, the attacker can issue a &#8220;git branch -m production&#8221; command and delete all the existing code and thus bring the application down by deleting the &#8220;production&#8221; branch containing the code of the application.<\/li>\n<li>S3 Bucket<br \/>\nThe Jenkins console might have access to private S3 buckets containing content such as images, log files, code backups etc. This access to essential data can be abused to delete important files and folders.<\/li>\n<\/ul>\n<h3><span style=\"color: #ff6600;\">Best Practices to follow<\/span><\/h3>\n<p>By default, Jenkins has no security check enabled. The Jenkins console can be accessed by anyone who has the URL and can configure Jenkins, create and edit jobs and perform builds. This can be safeguard by adding two layers of protection:<\/p>\n<ul>\n<li>Making Jenkins URL accessible only from the trustable IP addresses.<\/li>\n<li>Enabling Authentication in Jenkins console using Acess Control.<img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-30443 \" src=\"\/blog\/wp-ttn-blog\/uploads\/2015\/12\/jenkins2.jpg\" alt=\"Blog image\" width=\"606\" height=\"233\" \/><\/li>\n<\/ul>\n<ul>\n<li>To further enhance security, we must select Authorization under the Access Control option. Enabling &#8220;Project-based Matrix Authorization Strategy\u201d will ensure that we are granting required access only to the users who are eligible for it. This also enables us to provide access based on Projects.<img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-30435\" src=\"\/blog\/wp-ttn-blog\/uploads\/2015\/12\/jenkins3.png\" alt=\"jenkins3\" width=\"609\" height=\"160\" \/><\/li>\n<\/ul>\n<p>For detailed steps to enable the above-mentioned security settings, follow the following blog:<br \/>\n<a href=\"https:\/\/tothenewco.pro\/blog\/jenkins-implementing-project-based-matrix-authorization-strategy\/\">Jenkins \u2013 Implementing Project-based Matrix Authorization Strategy<\/a><\/p>\n<ul>\n<li>Enable option &#8220;Prevent Cross Site Request Forgery exploits&#8221; and use \u201ccrumbs\u201d to defend Jenkins against CSRF attacks.<br \/>\n<img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-30436\" src=\"\/blog\/wp-ttn-blog\/uploads\/2015\/12\/jenkins4.png\" alt=\"jenkins4\" width=\"609\" height=\"308\" \/><\/li>\n<\/ul>\n<p>The reason why CSRF Protection is not enabled by default is that some Jenkins APIs are difficult to use when this option enabled. Some features may not work at all. Some reverse proxies may filter the &#8220;crumb&#8221; parameter, resulting in failures when trying to use certain actions.<\/p>\n<p>So, a compromised Jenkins server can cause loss of control over complete infrastructure and resources.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>I was recently searching for something on Google and came across this instance of what might be a logical vulnerability prevailing across multiple web applications. I was searching for publicly accessible Jenkins console through Google Dorking. My search query\u00a0listed some of the websites that had Jenkins as a part of their domain name.\u00a0Although this itself [&hellip;]<\/p>\n","protected":false},"author":166,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"iawp_total_views":21,"footnotes":""},"categories":[2026,1174,1],"tags":[2040,2848,2270,1221,2847,248,2844,2876,2845,2846,2852,1682,2849,2700,2850,2851,2701],"class_list":["post-30380","post","type-post","status-publish","format-standard","hentry","category-appsec","category-aws-2","category-technology","tag-access-control","tag-access-control-in-jenkins","tag-application-security","tag-authentication","tag-authorization","tag-aws","tag-ci","tag-compromised-jenkins","tag-continuous-integration","tag-csrf","tag-insecure-jenkins","tag-jenkins","tag-jenkins-console","tag-project-based-security","tag-publicly-accessible","tag-publicly-accessible-console","tag-security-in-jenkins"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.0.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"I was recently searching for something on Google and came across this instance of what might be a logical vulnerability prevailing across multiple web applications. I was searching for publicly accessible Jenkins console through Google Dorking. My search query listed some of the websites that had Jenkins as a part of their domain name. Although this itself\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Ankit Giri\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/tothenewco.pro\/blog\/why-compromised-jenkins-can-lead-to-a-disaster\/\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.0.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"TO THE NEW BLOG\" \/>\n\t\t<meta property=\"og:type\" content=\"blog\" \/>\n\t\t<meta property=\"og:title\" content=\"Why compromised Jenkins can lead to a disaster? | TO THE NEW Blog\" \/>\n\t\t<meta property=\"og:description\" content=\"I was recently searching for something on Google and came across this instance of what might be a logical vulnerability prevailing across multiple web applications. I was searching for publicly accessible Jenkins console through Google Dorking. My search query listed some of the websites that had Jenkins as a part of their domain name. Although this itself\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/tothenewco.pro\/blog\/why-compromised-jenkins-can-lead-to-a-disaster\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/tothenewco.pro\/blog\/wp-content\/themes\/ttn\/images\/social-logo.png\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/tothenewco.pro\/blog\/wp-content\/themes\/ttn\/images\/social-logo.png\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@tothenew\" \/>\n\t\t<meta name=\"twitter:title\" content=\"Why compromised Jenkins can lead to a disaster? | TO THE NEW Blog\" \/>\n\t\t<meta name=\"twitter:description\" content=\"I was recently searching for something on Google and came across this instance of what might be a logical vulnerability prevailing across multiple web applications. I was searching for publicly accessible Jenkins console through Google Dorking. My search query listed some of the websites that had Jenkins as a part of their domain name. Although this itself\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/tothenewco.pro\/blog\/wp-content\/themes\/ttn\/images\/social-logo.png\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/why-compromised-jenkins-can-lead-to-a-disaster\\\/#article\",\"name\":\"Why compromised Jenkins can lead to a disaster? | TO THE NEW Blog\",\"headline\":\"Why compromised Jenkins can lead to a disaster?\",\"author\":{\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/author\\\/ankit-giri\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"\\\/blog\\\/wp-ttn-blog\\\/uploads\\\/2015\\\/12\\\/jenkins-main.png\",\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/why-compromised-jenkins-can-lead-to-a-disaster\\\/#articleImage\"},\"datePublished\":\"2015-12-04T17:18:34+05:30\",\"dateModified\":\"2015-12-07T15:43:54+05:30\",\"inLanguage\":\"en-US\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/why-compromised-jenkins-can-lead-to-a-disaster\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/why-compromised-jenkins-can-lead-to-a-disaster\\\/#webpage\"},\"articleSection\":\"Application Security, AWS, Technology, access control, access control in jenkins, application security, authentication, authorization, aws, ci, compromised Jenkins, continuous integration, CSRF, insecure Jenkins, Jenkins, Jenkins console, Project Based Security, publicly accessible, publicly accessible console, Security in Jenkins\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/why-compromised-jenkins-can-lead-to-a-disaster\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.tothenew.com\\\/blog\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/category\\\/technology\\\/#listItem\",\"name\":\"Technology\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/category\\\/technology\\\/#listItem\",\"position\":2,\"name\":\"Technology\",\"item\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/category\\\/technology\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/why-compromised-jenkins-can-lead-to-a-disaster\\\/#listItem\",\"name\":\"Why compromised Jenkins can lead to a disaster?\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/why-compromised-jenkins-can-lead-to-a-disaster\\\/#listItem\",\"position\":3,\"name\":\"Why compromised Jenkins can lead to a disaster?\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/category\\\/technology\\\/#listItem\",\"name\":\"Technology\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/#organization\",\"name\":\"TO THE NEW Blog\",\"url\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/author\\\/ankit-giri\\\/#author\",\"url\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/author\\\/ankit-giri\\\/\",\"name\":\"Ankit Giri\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/why-compromised-jenkins-can-lead-to-a-disaster\\\/#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f7639925261ba287537045f98e71a21cfc236396dbcf355c63c4002fd4a083e5?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"Ankit Giri\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/why-compromised-jenkins-can-lead-to-a-disaster\\\/#webpage\",\"url\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/why-compromised-jenkins-can-lead-to-a-disaster\\\/\",\"name\":\"Why compromised Jenkins can lead to a disaster? | TO THE NEW Blog\",\"description\":\"I was recently searching for something on Google and came across this instance of what might be a logical vulnerability prevailing across multiple web applications. I was searching for publicly accessible Jenkins console through Google Dorking. My search query listed some of the websites that had Jenkins as a part of their domain name. Although this itself\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/why-compromised-jenkins-can-lead-to-a-disaster\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/author\\\/ankit-giri\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/author\\\/ankit-giri\\\/#author\"},\"datePublished\":\"2015-12-04T17:18:34+05:30\",\"dateModified\":\"2015-12-07T15:43:54+05:30\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/\",\"name\":\"TO THE NEW Blog\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"Why compromised Jenkins can lead to a disaster? | TO THE NEW Blog","description":"I was recently searching for something on Google and came across this instance of what might be a logical vulnerability prevailing across multiple web applications. I was searching for publicly accessible Jenkins console through Google Dorking. My search query listed some of the websites that had Jenkins as a part of their domain name. Although this itself","canonical_url":"https:\/\/tothenewco.pro\/blog\/why-compromised-jenkins-can-lead-to-a-disaster\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/tothenewco.pro\/blog\/why-compromised-jenkins-can-lead-to-a-disaster\/#article","name":"Why compromised Jenkins can lead to a disaster? | TO THE NEW Blog","headline":"Why compromised Jenkins can lead to a disaster?","author":{"@id":"https:\/\/tothenewco.pro\/blog\/author\/ankit-giri\/#author"},"publisher":{"@id":"https:\/\/tothenewco.pro\/blog\/#organization"},"image":{"@type":"ImageObject","url":"\/blog\/wp-ttn-blog\/uploads\/2015\/12\/jenkins-main.png","@id":"https:\/\/tothenewco.pro\/blog\/why-compromised-jenkins-can-lead-to-a-disaster\/#articleImage"},"datePublished":"2015-12-04T17:18:34+05:30","dateModified":"2015-12-07T15:43:54+05:30","inLanguage":"en-US","mainEntityOfPage":{"@id":"https:\/\/tothenewco.pro\/blog\/why-compromised-jenkins-can-lead-to-a-disaster\/#webpage"},"isPartOf":{"@id":"https:\/\/tothenewco.pro\/blog\/why-compromised-jenkins-can-lead-to-a-disaster\/#webpage"},"articleSection":"Application Security, AWS, Technology, access control, access control in jenkins, application security, authentication, authorization, aws, ci, compromised Jenkins, continuous integration, CSRF, insecure Jenkins, Jenkins, Jenkins console, Project Based Security, publicly accessible, publicly accessible console, Security in Jenkins"},{"@type":"BreadcrumbList","@id":"https:\/\/tothenewco.pro\/blog\/why-compromised-jenkins-can-lead-to-a-disaster\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/tothenewco.pro\/blog#listItem","position":1,"name":"Home","item":"https:\/\/tothenewco.pro\/blog","nextItem":{"@type":"ListItem","@id":"https:\/\/tothenewco.pro\/blog\/category\/technology\/#listItem","name":"Technology"}},{"@type":"ListItem","@id":"https:\/\/tothenewco.pro\/blog\/category\/technology\/#listItem","position":2,"name":"Technology","item":"https:\/\/tothenewco.pro\/blog\/category\/technology\/","nextItem":{"@type":"ListItem","@id":"https:\/\/tothenewco.pro\/blog\/why-compromised-jenkins-can-lead-to-a-disaster\/#listItem","name":"Why compromised Jenkins can lead to a disaster?"},"previousItem":{"@type":"ListItem","@id":"https:\/\/tothenewco.pro\/blog#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/tothenewco.pro\/blog\/why-compromised-jenkins-can-lead-to-a-disaster\/#listItem","position":3,"name":"Why compromised Jenkins can lead to a disaster?","previousItem":{"@type":"ListItem","@id":"https:\/\/tothenewco.pro\/blog\/category\/technology\/#listItem","name":"Technology"}}]},{"@type":"Organization","@id":"https:\/\/tothenewco.pro\/blog\/#organization","name":"TO THE NEW Blog","url":"https:\/\/tothenewco.pro\/blog\/"},{"@type":"Person","@id":"https:\/\/tothenewco.pro\/blog\/author\/ankit-giri\/#author","url":"https:\/\/tothenewco.pro\/blog\/author\/ankit-giri\/","name":"Ankit Giri","image":{"@type":"ImageObject","@id":"https:\/\/tothenewco.pro\/blog\/why-compromised-jenkins-can-lead-to-a-disaster\/#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/f7639925261ba287537045f98e71a21cfc236396dbcf355c63c4002fd4a083e5?s=96&d=mm&r=g","width":96,"height":96,"caption":"Ankit Giri"}},{"@type":"WebPage","@id":"https:\/\/tothenewco.pro\/blog\/why-compromised-jenkins-can-lead-to-a-disaster\/#webpage","url":"https:\/\/tothenewco.pro\/blog\/why-compromised-jenkins-can-lead-to-a-disaster\/","name":"Why compromised Jenkins can lead to a disaster? | TO THE NEW Blog","description":"I was recently searching for something on Google and came across this instance of what might be a logical vulnerability prevailing across multiple web applications. I was searching for publicly accessible Jenkins console through Google Dorking. My search query listed some of the websites that had Jenkins as a part of their domain name. Although this itself","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/tothenewco.pro\/blog\/#website"},"breadcrumb":{"@id":"https:\/\/tothenewco.pro\/blog\/why-compromised-jenkins-can-lead-to-a-disaster\/#breadcrumblist"},"author":{"@id":"https:\/\/tothenewco.pro\/blog\/author\/ankit-giri\/#author"},"creator":{"@id":"https:\/\/tothenewco.pro\/blog\/author\/ankit-giri\/#author"},"datePublished":"2015-12-04T17:18:34+05:30","dateModified":"2015-12-07T15:43:54+05:30"},{"@type":"WebSite","@id":"https:\/\/tothenewco.pro\/blog\/#website","url":"https:\/\/tothenewco.pro\/blog\/","name":"TO THE NEW Blog","inLanguage":"en-US","publisher":{"@id":"https:\/\/tothenewco.pro\/blog\/#organization"}}]},"og:locale":"en_US","og:site_name":"TO THE NEW BLOG","og:type":"blog","og:title":"Why compromised Jenkins can lead to a disaster? | TO THE NEW Blog","og:description":"I was recently searching for something on Google and came across this instance of what might be a logical vulnerability prevailing across multiple web applications. I was searching for publicly accessible Jenkins console through Google Dorking. My search query listed some of the websites that had Jenkins as a part of their domain name. Although this itself","og:url":"https:\/\/tothenewco.pro\/blog\/why-compromised-jenkins-can-lead-to-a-disaster\/","og:image":"https:\/\/tothenewco.pro\/blog\/wp-content\/themes\/ttn\/images\/social-logo.png","og:image:secure_url":"https:\/\/tothenewco.pro\/blog\/wp-content\/themes\/ttn\/images\/social-logo.png","twitter:card":"summary","twitter:site":"@tothenew","twitter:title":"Why compromised Jenkins can lead to a disaster? | TO THE NEW Blog","twitter:description":"I was recently searching for something on Google and came across this instance of what might be a logical vulnerability prevailing across multiple web applications. I was searching for publicly accessible Jenkins console through Google Dorking. My search query listed some of the websites that had Jenkins as a part of their domain name. Although this itself","twitter:image":"https:\/\/tothenewco.pro\/blog\/wp-content\/themes\/ttn\/images\/social-logo.png"},"aioseo_meta_data":{"post_id":"30380","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":"","og_description":"","og_object_type":"blog","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":"","og_article_tags":"","twitter_use_og":false,"twitter_card":"summary","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"limit_modified_date":false,"created":"2021-04-29 12:14:44","updated":"2024-02-29 08:25:58","focus_keyword":null,"additional_keywords":null,"truseo_locale":null,"ai":null,"breadcrumb_settings":null,"seo_analyzer_scan_date":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/tothenewco.pro\/blog\" title=\"Home\">Home<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/tothenewco.pro\/blog\/category\/technology\/\" title=\"Technology\">Technology<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\tWhy compromised Jenkins can lead to a disaster?\n\t\t<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/tothenewco.pro\/blog"},{"label":"Technology","link":"https:\/\/tothenewco.pro\/blog\/category\/technology\/"},{"label":"Why compromised Jenkins can lead to a disaster?","link":"https:\/\/tothenewco.pro\/blog\/why-compromised-jenkins-can-lead-to-a-disaster\/"}],"_links":{"self":[{"href":"https:\/\/tothenewco.pro\/blog\/wp-json\/wp\/v2\/posts\/30380","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tothenewco.pro\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tothenewco.pro\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tothenewco.pro\/blog\/wp-json\/wp\/v2\/users\/166"}],"replies":[{"embeddable":true,"href":"https:\/\/tothenewco.pro\/blog\/wp-json\/wp\/v2\/comments?post=30380"}],"version-history":[{"count":0,"href":"https:\/\/tothenewco.pro\/blog\/wp-json\/wp\/v2\/posts\/30380\/revisions"}],"wp:attachment":[{"href":"https:\/\/tothenewco.pro\/blog\/wp-json\/wp\/v2\/media?parent=30380"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tothenewco.pro\/blog\/wp-json\/wp\/v2\/categories?post=30380"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tothenewco.pro\/blog\/wp-json\/wp\/v2\/tags?post=30380"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}