Jenkins vulnerabilities

Multiple open redirect vulnerabilities in Jenkins before 2.3 and LTS before 1.651.2 allow remote attackers to redirect users to arbitrary web sites, potentially leading to phishing attacks.

Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando.

Jenkins before 1.640 and LTS before 1.625.2 allow remote attackers to bypass the CSRF protection mechanism via unspecified vectors.

CVE-2015-7537 is a CSRF vulnerability in Jenkins before version 1.640 and LTS before version 1.625.2 that allows remote attackers to hijack the authentication of administrators via unspecified vectors related to the HTTP GET method.

Jenkins before 1.638 and LTS before 1.625.2 allow attackers to bypass intended slave-to-master access restrictions by leveraging a JNLP slave.

Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to conduct clickjacking attacks via unspecified vectors.

Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to execute arbitrary code via a crafted packet to the CLI channel.

In Jenkins 2.575 and earlier, and LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved via a fallback path in Remoting deserialization. This allows agents, code on agents, and attackers with Agent/Connect permission to bypass the filter for classes on the Jenkins core classpath.

In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, an attacker can deserialize arbitrary types from Jenkins core or plugins via a crafted `config.xml` submission. This allows handling HTTP requests, impersonating any user, executing arbitrary code via the Script Console, or reading arbitrary files from the Jenkins controller.

The re-key admin monitor was introduced in Jenkins 1.498, re-encrypting all secrets in JENKINS_HOME with a new key and creating a backup directory with old secrets and the key used for encryption. These backups were world-readable and not removed afterwards.

Jenkins before version 1.650 and LTS before 1.642.2 do not use a constant-time algorithm to verify CSRF tokens, making it easier for remote attackers to bypass the CSRF protection mechanism via a brute-force approach.

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy configuration. Attackers with Overall/Manage permission can instantiate arbitrary types related to configuration, including those intended only for administrators.

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names inconsistently. Attackers able to create new users or groups with names that case-insensitively match other characters can impersonate other users or be granted their permissions in some circumstances.

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names, allowing attackers with Item/Configure and Item/Build permission to write files to arbitrary locations on the controller file system.

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of `.tar` and `.tar.gz` archives, allowing attackers able to control agent processes to provide crafted archives to the controller to write files to arbitrary locations on the file system, restricted only by file system access permissions of the user running Jenkins.

Jenkins versions 2.567 and earlier, and LTS 2.555.2 and earlier do not encrypt secrets from POST config.xml submissions before storing them unencrypted in job configuration files. Secrets are stored in config.xml files in plaintext, allowing users with Item/Extended Read permissions or access to the Jenkins controller file system to view them.

A stored XSS vulnerability in Jenkins allows attackers with Agent/Configure permission to inject malicious scripts via an unescaped offline cause description set through the POST config.xml API. Affects Jenkins 2.483 through 2.567 and LTS 2.492.1 through 2.555.2.

Jenkins versions 2.567 and earlier, LTS 2.555.2 and earlier do not validate the safety of the 'from' parameter in the 'Delegate to servlet container' security realm, allowing attackers to perform phishing attacks by redirecting users to attacker-controlled domains.

Missing permission checks in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allow attackers with Overall/Read permission to determine other users' configured timezone and to enumerate view names of other users' 'My Views'.

A missing permission check in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allows attackers with Item/Cancel permission, but lacking Item/Read permission, to cancel queue items they do not have permission to view.

A vulnerability in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains tab or newline characters between `//`, allowing attackers to perform phishing attacks.

Jenkins versions 2.567 and earlier, LTS 2.555.2 and earlier improperly determine that a redirect URL after login legitimately points to Jenkins when it contains relative path segments (`./` or `../`), allowing attackers to perform phishing attacks.

A vulnerability in Jenkins 2.554 and earlier, and LTS 2.541.2 and earlier, allows unsafe handling of symbolic links during extraction of .tar and .tar.gz archives. This can enable writing files to arbitrary filesystem locations, restricted only by Jenkins user permissions.

Jenkins versions 2.415 and earlier, and LTS 2.401.2 and earlier do not sanitize or properly encode URLs in build logs when transforming them into hyperlinks, resulting in a stored XSS vulnerability exploitable by attackers able to control build log contents.

In Jenkins versions 2.399 and earlier, and LTS 2.387.3 and earlier, POST requests are sent to load the list of context actions. If part of the URL includes insufficiently escaped user-provided values, a victim may be tricked into sending a POST request to an unexpected endpoint by opening a context menu.