Recent findings have revealed two significant security flaws in Jenkins, a widely-used open-source automation platform. These vulnerabilities pose serious risks, potentially enabling malicious actors to access arbitrary files from the Jenkins controller file system and execute remote code.
Jenkins is an essential tool in the software development lifecycle, automating tasks such as code building, testing, and deployment. It packages and compiles code into executables, facilitating automated testing and subsequent deployment to production environments.
Remote Code Execution (RCE) vulnerabilities are particularly dangerous as they allow attackers to run arbitrary code on a system remotely, without needing physical access. This can lead to unauthorized data access and full system compromise.
Arbitrary File Read Vulnerability (CVE-2024-43044)
The first issue, tracked as SECURITY-3430, impacts Jenkins versions 2.470 and older, including LTS versions up to 2.452.3. The flaw resides in the Remoting library’s ClassLoaderProxy#fetchJar method, which fails to limit the paths agents can request. Consequently, attackers with Agent/Connect permissions can potentially access any file on the Jenkins controller file system.
This vulnerability is deemed critical, as it can be exploited to escalate privileges to remote code execution. CloudBees, Inc.’s Daniel Beck identified this flaw. Fixes have been issued in Jenkins versions 2.471, LTS 2.452.4, and LTS 2.462.1.
Permission Check Flaw (CVE-2024-43045)
The second vulnerability, SECURITY-3349, affects Jenkins versions 2.470 and earlier, including LTS versions up to 2.452.3. This issue stems from an HTTP endpoint that lacks proper permission validation, allowing users with Overall/Read access to view other users’ “My Views.” Additionally, users with global View/Configure and View/Delete permissions can alter or remove others’ “My Views.”
Discovered by Jiangchenwei and Yangyue from Nebulalab, this medium-severity vulnerability has also been addressed in Jenkins versions 2.471, LTS 2.452.4, and LTS 2.462.1.
To mitigate these risks, Jenkins users are advised to upgrade to the latest versions: Jenkins weekly to 2.471 and Jenkins LTS to either 2.452.4 or 2.462.1. These updates incorporate fixes for the mentioned vulnerabilities, and earlier versions remain susceptible until patched.
