Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS05OGZwLXIyMmctd3BqN84AAz2W

Jenkins CSRF protection bypass vulnerability

Jenkins provides context menus for various UI elements, like links to jobs and builds, or breadcrumbs.

In Jenkins 2.399 and earlier, LTS 2.387.3 and earlier, POST requests are sent in order to load the list of context actions. If part of the URL includes insufficiently escaped user-provided values, a victim may be tricked into sending a POST request to an unexpected endpoint (e.g., the Script Console) by opening a context menu.

As of publication of this advisory, we are aware of insufficiently escaped context menu URLs for label expressions, allowing attackers with Item/Configure permissions to exploit this vulnerability.

Jenkins 2.400, LTS 2.401.1 sends GET requests to load the list of context actions.

Permalink: https://github.com/advisories/GHSA-98fp-r22g-wpj7
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS05OGZwLXIyMmctd3BqN84AAz2W
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 11 months ago
Updated: 6 months ago

CVSS Score: 8.0
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Identifiers: GHSA-98fp-r22g-wpj7, CVE-2023-35141
References:

• https://nvd.nist.gov/vuln/detail/CVE-2023-35141
• https://www.jenkins.io/security/advisory/2023-06-14/#SECURITY-3135
• http://www.openwall.com/lists/oss-security/2023/06/14/5
• https://github.com/CVEProject/cvelist/blob/f37e157216b8e5e64a6db80b7b68bde0088277fe/2023/35xxx/CVE-2023-35141
• https://github.com/advisories/GHSA-98fp-r22g-wpj7

Repository: https://github.com/CVEProject/cvelist
Blast Radius: 1.0

Affected Packages