CVE-2023-24456: Session fixation vulnerability in Jenkins Keycloak Authentication Plugin
Summary
CVE-2023-24456: Session fixation vulnerability in Jenkins Keycloak Authentication Plugin. Affects org.jenkins-ci.plugins:keycloak versions < 2.3.1. Fixed in 2.3.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins Keycloak Authentication Plugin is a Maven package that provides authentication support for Jenkins using Keycloak. It allows users to authenticate with their Keycloak credentials and access Jenkins. This plugin is widely used in Jenkins installations for secure authentication.
Vulnerability Detail
The Jenkins Keycloak Authentication Plugin version 2.3.0 and earlier is affected by a session fixation vulnerability. This vulnerability occurs because the plugin fails to invalidate the previous session upon login. An attacker can exploit this vulnerability by fixing a session and then using the fixed session to gain unauthorized access to Jenkins. This can lead to unauthorized actions, data leakage, or privilege escalation.
How To Fix
Minimum fixed version
2.3.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the plugin to the latest version to mitigate the risk.
Conclusion
The Jenkins Keycloak Authentication Plugin version 2.3.0 and earlier is affected by a session fixation vulnerability. To mitigate the risk, it is crucial to update the plugin to version 2.3.1 or later. This update includes a fix for the vulnerability. Users should follow the standard plugin update process in Jenkins to apply the fix. For additional support, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:keycloak →
FAQ
This vulnerability allows an attacker to fix a session and gain unauthorized access to Jenkins, potentially leading to unauthorized actions, data leakage, or privilege escalation.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, and you can easily verify the impact without any signup.
Yes, a fix is available for this vulnerability. Users should update the Jenkins Keycloak Authentication Plugin to version 2.3.1 or later to mitigate the risk.
No, there is no known workaround for this vulnerability. It is crucial to update the plugin to the latest version as soon as possible.
For further support on vulnerability remediation, you can reach out to info@devnack.com. They can provide guidance and assistance in resolving the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:keycloak.
