CVE-2023-40341: Jenkins Blue Ocean Plugin CSRF Vulnerability
Summary
CVE-2023-40341: Jenkins Blue Ocean Plugin cross-site request forgery vulnerability. Affects io.jenkins.blueocean:blueocean versions < 1.27.5.1. Fixed in 1.27.5.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Blue Ocean Plugin is a popular plugin for the Jenkins automation server that provides a modern user interface for visualizing and managing continuous integration and delivery pipelines. It enhances the user experience by offering a more intuitive and interactive interface. The plugin is widely used in software development organizations to streamline their CI/CD processes.
Vulnerability Detail
The Jenkins Blue Ocean Plugin version 1.27.5 and earlier is vulnerable to a cross-site request forgery (CSRF) attack. This vulnerability arises due to the plugin not requiring POST requests for an HTTP endpoint. As a result, an attacker can exploit this vulnerability to connect to a URL of their choice and capture GitHub credentials associated with a specific job. This issue is a result of an incomplete fix of a previous vulnerability (SECURITY-2502). The Blue Ocean Plugin version 1.27.5.1 addresses this vulnerability by using the configured SCM URL instead of a user-specified URL provided as a parameter to the HTTP endpoint.
How To Fix
Minimum fixed version
1.27.5.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the fix by upgrading to the patched version of the Jenkins Blue Ocean Plugin.
Conclusion
The Jenkins Blue Ocean Plugin version 1.27.5 and earlier is vulnerable to a CSRF attack, allowing an attacker to capture GitHub credentials associated with a specific job. To mitigate this vulnerability, it is crucial to upgrade to version 1.27.5.1 or later. There is no known workaround for this issue. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.jenkins.blueocean:blueocean →
FAQ
A CSRF vulnerability allows an attacker to perform actions on behalf of an authenticated user without their consent or knowledge. In the case of this Jenkins Blue Ocean Plugin vulnerability, an attacker can capture GitHub credentials associated with a specific job.
The impact of this vulnerability is that an attacker can potentially gain unauthorized access to GitHub credentials, compromising the security of the affected Jenkins instance and potentially exposing sensitive information.
No, only versions 1.27.5 and earlier are affected by this vulnerability. The issue has been addressed in version 1.27.5.1 and later.
There is no known public exploit for this vulnerability at the time of this report. However, it is crucial to apply the fix promptly to mitigate any potential risks.
In most cases, restarting Jenkins is not required after updating a plugin. However, it is recommended to review the Jenkins documentation or consult with your system administrator for specific instructions.
Related vulnerabilities
Recent vulnerabilities recorded for io.jenkins.blueocean:blueocean.
