Jenkins Security Advisory 2024-10-28: RCE, Info Leak, DoS in Core and 30+ Plugins

Jenkins Security Advisory 2024-10-28 Vulnerability Summary Vulnerability Overview This security advisory was published on October 28, 2024, and covers multiple security vulnerabilities in Jenkins and several of its plugins. The primary vulnerability types include: Information Disclosure (e.g., proxy configurations, build parameters, environment variables) Denial of Service (DoS) (e.g., memory exhaustion, thread blocking) Privilege Escalation / Unauthorized Access (e.g., bypassing permission controls, executing arbitrary commands) Cross-Site Scripting (XSS) Path Traversal / File Read Security Risks Due to Misconfigurations Some vulnerabilities allow attackers to obtain sensitive information, execute malicious code, or render services unavailable without authentication or with low privileges. --- Scope of Impact Core Jenkins All versions ≤ 2.452 (some vulnerabilities affect earlier versions) Affected Plugins and Versions: > Note: Some vulnerabilities only affect specific plugin combinations or configuration scenarios. --- Remediation General Recommendations: Immediately upgrade all affected Jenkins core and plugins to the "fixed versions" specified in the advisory. If immediate upgrades are not possible, implement temporary mitigations (e.g., disable related features, restrict network access, strengthen permission controls). Review and audit existing configurations to remove unnecessary exposure of sensitive information (e.g., proxy settings, credential bindings). Enable security plugins (e.g., "Security Realm", "Role-Based Authorization") to strengthen access control. Specific Fixed Versions (Examples): Jenkins Core → ≥ 2.453 Blue Ocean → ≥ 1.27.11 JCasC → ≥ 1.81 Credentials Binding → ≥ 5.1 Docker Pipeline → ≥ 1.31 GitLab Plugin → ≥ 1.6.1 GitHub Organization Folder → ≥ 5.0.1 Matrix Authorization → ≥ 3.1.7 Pipeline Stage View → ≥ 2.22 Role-Based Authorization → ≥ 2.11 SSH Agent → ≥ 1.11 View Job Filter → ≥ 1.41 Workflow Step Timeout → ≥ 2.11 XUnit Plugin → ≥ 2.4.1 > See the original document for the complete list of fixed versions per vulnerability entry. --- POC / Exploit Code Extraction ⚠️ Warning: This page does not contain any actual exploitable POC code or attack scripts. All descriptions pertain to vulnerability mechanics, impact, and remediation recommendations; no directly executable attack code is provided. Terms such as "exploit" and "proof-of-concept" mentioned in the original text are used solely to describe vulnerability behavior and do not include specific code implementations. --- Conclusion This security advisory is extensive, covering multiple critical components within the Jenkins ecosystem. Administrators are advised to: 1. Immediately check current Jenkins and plugin versions; 2. Upgrade to the fixed versions listed in the advisory; 3. Review configurations and disable non-essential features; 4. Strengthen permission management and network isolation; 5. Monitor for subsequent official updates. > Official Link: https://www.jenkins.io/security/advisory/2024-10-28/

Goal Reached Thanks to every supporter — we hit 100%!

Jenkins Security Advisory 2024-10-28: RCE, Info Leak, DoS in Core and 30+ Plugins