Jenkins Plugin Security Advisories: CSRF, XXE, and Plaintext Credential Storage

Critical Vulnerability Information 1. CSRF Vulnerability and Missing Permission Checks in Analysis Core Plugin Severity: Medium Affected Plugin: analysis-core Description: No permission checks are performed on configuration forms and form submission handlers, allowing attackers with Job/Read access to modify the default graph configuration for every job of all users. Additionally, the form submission handler does not require a POST request, leading to a Cross-Site Request Forgery (CSRF) vulnerability. 2. Site Monitor Plugin Unconditionally Disables SSL/TLS Certificate Verification Globally Severity: Medium Affected Plugin: sitemonitor Description: Unconditionally disables SSL/TLS certificate verification for the entire Jenkins controller JVM. There is now an option to ignore SSL/TLS errors on a per-site basis. 3. XXE Vulnerability via Swarm Plugin Client UDP Broadcast Responses Severity: Medium Affected Plugin: swarm Description: The XML parser is not configured to prevent XML External Entity (XXE) processing, allowing unauthorized attackers on the network to make the Swarm client parse maliciously crafted XML responses using external entities, potentially reading arbitrary files on the Swarm client or causing a denial-of-service attack. 4. CSRF Vulnerability and Missing Permission Checks in Ansible Tower Plugin Leading to Credential Capture Severity: Medium Affected Plugin: ansible-tower Description: Permission checks are not enforced on methods implementing form validation, allowing users with Overall/Read access to connect to Jenkins using an attacker-specified URL and an attacker-specified credential ID obtained via another method, thereby capturing credentials stored in Jenkins. This form validation method does not require a POST request, resulting in a CSRF vulnerability. 5. Users Can Enumerate Credential IDs via Ansible Tower Plugin Severity: Medium Affected Plugin: ansible-tower Description: No permission checks are performed, allowing any user with Overall/Read access to retrieve a list of valid credential IDs, which can be exploited to capture credentials via another vulnerability. 6. Microsoft Entra ID Plugin Stores Credentials in Plaintext Severity: Low Affected Plugin: azure-ad Description: Stores client secrets in plaintext within the global config.xml configuration file on the Jenkins controller, which can be viewed by users with filesystem access to the Jenkins controller. 7. Twitter Plugin Stores Credentials in Plaintext Severity: Low Affected Plugin: twitter Description: Stores credentials in plaintext within its global configuration file, which can be viewed by users with filesystem access to the Jenkins controller. 8. Koji Plugin Unconditionally Disables SSL/TLS Certificate Verification Globally Severity: Medium Affected Plugin: koji Description: Unconditionally disables SSL/TLS certificate verification for the entire Jenkins controller JVM. 9. CSRF Vulnerability in OAuth Callback of GitHub Authentication Plugin Severity: Medium Affected Plugin: github-oauth Description: The OAuth state parameter is not managed to prevent CSRF, allowing attackers to obtain the OAuth redirect URL during authentication and send it to victims. If the victim is logged into Jenkins, their Jenkins account will be linked to the attacker’s GitHub account. 10. Aqua MicroScanner Plugin Stores Credentials in Plaintext Severity: Low Affected Plugin: aqua-microscanner Description: Stores credentials in plaintext within its global configuration file, which can be viewed by users with filesystem access to the Jenkins controller.

Goal Reached Thanks to every supporter — we hit 100%!

Jenkins Plugin Security Advisories: CSRF, XXE, and Plaintext Credential Storage