CVE-2023-24447: Cross-site request forgery vulnerability in Jenkins RabbitMQ Consumer Plugin
Summary
CVE-2023-24447: Cross-site request forgery vulnerability in Jenkins RabbitMQ Consumer Plugin. Affects org.jenkins-ci.plugins:rabbitmq-consumer versions < 2.8. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Jenkins RabbitMQ Consumer Plugin is a Maven package that enables Jenkins to consume messages from RabbitMQ queues. It provides functionality for connecting to RabbitMQ servers and processing messages. The plugin is widely used in Jenkins environments to integrate with RabbitMQ and automate various tasks. However, versions 2.8 and earlier of the plugin are vulnerable to a cross-site request forgery (CSRF) attack.
Vulnerability Detail
The CSRF vulnerability in Jenkins RabbitMQ Consumer Plugin allows attackers to exploit the plugin's functionality to connect to an attacker-specified AMQP(S) URL using an attacker-specified username and password. This can lead to unauthorized access to RabbitMQ servers and potential misuse of the messaging system. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the Jenkins RabbitMQ Consumer Plugin to a non-vulnerable version.
Conclusion
The Jenkins RabbitMQ Consumer Plugin is vulnerable to a CSRF attack that allows unauthorized access to RabbitMQ servers. To mitigate this vulnerability, it is crucial to update the plugin to a non-vulnerable version, specifically version 2.9 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:rabbitmq-consumer →
FAQ
The vulnerability allows attackers to connect to RabbitMQ servers using unauthorized credentials, potentially leading to unauthorized access and misuse of the messaging system.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file.
Yes, a fix is available for this vulnerability. Developers should update their Jenkins environment to use version 2.9 or later of the Jenkins RabbitMQ Consumer Plugin.
There are no known workarounds for this vulnerability. It is crucial to update the plugin to a non-vulnerable version.
The vulnerability has a CVSS score of 8.8, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:rabbitmq-consumer.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
