Matrix.org 2019 breach started with an outdated Jenkins

This is a post-mortem from 2019, where an attacker gained initial access via an outdated Jenkins. The entry point was CVE-2019-1003000, a sandbox bypass in the Script Security plugin that allows arbitrary code execution on the Jenkins master. On a compromised Jenkins slave the attacker abused forwarded SSH keys of the devops team and inserted their own SSH keys on the accessible hosts. Matrix’s initial disclosure shows how the cleanup went wrong: when the team rotated the compromised Cloudflare API key, “only personal keys were rotated”, so the attacker could still point the matrix.org DNS to a defacement page. The post-mortem includes many good lessons and improvements, starting with: never use SSH agent forwarding.