CVE-2025-64139: Jenkins Start Windocks Containers Plugin Lacks Permission Check Leading to CSRF Vulnerability
Summary
CVE-2025-64139: Jenkins Start Windocks Containers Plugin is missing a permission check. Affects org.jenkins-ci.plugins:windocks-start-container versions < 1.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Start Windocks Containers Plugin is designed to facilitate the management and deployment of Windocks containers within Jenkins, a popular open-source automation server. This plugin allows users to start and manage containerized applications seamlessly. However, the plugin versions up to 1.4 are vulnerable due to a lack of proper permission checks, exposing users to potential security risks.
Vulnerability Detail
The vulnerability arises from the Jenkins Start Windocks Containers Plugin failing to implement a necessary permission check in one of its HTTP endpoints. This oversight allows attackers with Overall/Read permission to connect to arbitrary URLs specified by them. Furthermore, the endpoint does not enforce POST requests, which introduces a cross-site request forgery (CSRF) vulnerability. This could lead to unauthorized actions being performed on behalf of authenticated users, potentially compromising sensitive data and system integrity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds provided to mitigate this vulnerability. Users are encouraged to limit access to the Jenkins instance and ensure that only trusted users have Overall/Read permissions until a fix is available.
Conclusion
The Jenkins Start Windocks Containers Plugin is currently vulnerable due to a lack of permission checks, allowing potential CSRF attacks. Users should remain vigilant and monitor for updates while limiting access to their Jenkins instances. The absence of a fix necessitates caution in managing permissions.
See every vulnerability recorded for org.jenkins-ci.plugins:windocks-start-container →
FAQ
The CVSS score for this vulnerability is 4.3, indicating a moderate level of severity.
The vulnerability affects Jenkins Start Windocks Containers Plugin versions 1.4 and earlier.
Attackers can exploit this vulnerability to connect to arbitrary URLs and potentially perform unauthorized actions on behalf of authenticated users.
As of now, there is no patch available for this vulnerability. Users should monitor the plugin's repository for any future updates.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just the pom.xml file. You can also check your application using the Vulert playground without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:windocks-start-container.
