CVE-2019-10405 — AI Deep Analysis Summary

🚨 **Essence**: Jenkins leaks HttpOnly cookies on `/whoAmI`. <br>💥 **Consequences**: Attackers steal authentication credentials. <br>📉 **Impact**: Full account takeover via stolen cookies.

🛠️ **Root Cause**: Configuration error. <br>❌ **Flaw**: The system prints sensitive cookie values despite `HttpOnly` flags. <br>📌 **CWE**: Not specified in data.

🏢 **Vendor**: CloudBees Jenkins / Hudson Labs. <br>📦 **Affected**: Versions ≤ 2.196. <br>📦 **LTS Affected**: Versions ≤ 2.176.3.

🕵️ **Action**: Steal cookie-based auth credentials. <br>🔓 **Privileges**: Gain unauthorized access. <br>📂 **Data**: Sensitive session info exposed via `/whoAmI`.

🔑 **Auth**: Unauthenticated access possible. <br>⚙️ **Config**: Exploits misconfiguration. <br>📊 **Threshold**: Low. Easy to trigger if URL is exposed.

📜 **PoC**: Yes, available via Nuclei templates. <br>🌍 **Exploit**: Publicly documented. <br>⚠️ **Risk**: High visibility in security communities.

🔍 **Check**: Scan `/whoAmI` endpoint. <br>🧪 **Tool**: Use Nuclei or similar scanners. <br>👀 **Look**: Check if cookie values are printed in response.

🛡️ **Fix**: Upgrade Jenkins. <br>📈 **Target**: Version > 2.196 or LTS > 2.176.3. <br>✅ **Status**: Official advisory released.

🚧 **Workaround**: Restrict access to `/whoAmI`. <br>🚫 **Block**: Prevent unauthenticated requests. <br>🔒 **Limit**: Use WAF rules to block sensitive endpoints.

🔥 **Priority**: HIGH. <br>⏳ **Urgency**: Patch immediately. <br>📢 **Reason**: Easy exploitation, direct credential theft.