All instance jobs run with high privileges

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_46
Category	Pipeline Based Access Controls
Severity	HIGH

Impact

Each executed Jenkins job is assigned with the privileges of a Jenkins user. These privileges are used to interact with the Jenkins system, and include creating jobs, running builds, and executing on the various configured Jenkins nodes. All jobs in the instance are configured to run with the Jenkins SYSTEM user account (that should not be confused with the operating system user). This user has high privileges over the system, and is allowed to perform any action on the Jenkins instance. An attacker executing malicious code in any job can take advantage of these privileges and perform impactful actions on the Jenkins instance and its nodes. For more information about access controls for builds: https://www.jenkins.io/doc/book/security/build-authorization/

Recommended Solution - Buildtime

Avoid running jobs with the SYSTEM user account, and configure a strict build authorization strategy based on the following guidelines:

1. Install the Authorize Project plugin.
2. On the Jenkins instance, under Manage Jenkins, browse to Configure Global Security.
3. Under Access Control for Builds, set Project default build authorization to one of the following:

   • Run as Anonymous
   • Run as User who triggered Build
   • Run as Specific user
4. In addition, configure the Per-project configurable Build Authorization setting to NOT include the Run as SYSTEM strategy, to prevent it from being configured for specific jobs. Instead, set one or more of the options above.

📌 NOTE Follow the least privilege principle when configuring a job to run by a specific user.