CVE-2023-28680
📋 TL;DR
The Jenkins Crap4J Plugin 0.9 and earlier contains an XML external entity (XXE) vulnerability due to improper XML parser configuration. This allows attackers to read arbitrary files from the Jenkins controller file system and potentially perform server-side request forgery (SSRF). All Jenkins instances using the vulnerable plugin versions are affected.
💻 Affected Systems
- Jenkins Crap4J Plugin
📦 What is this software?
Crap4j by Jenkins
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of Jenkins controller file system, sensitive data exfiltration, and potential remote code execution through SSRF attacks.
Likely Case
Unauthorized file system access leading to credential theft, configuration exposure, and potential privilege escalation.
If Mitigated
Limited impact with proper network segmentation and file system permissions, though XXE vulnerabilities remain dangerous.
🎯 Exploit Status
Exploitation requires authentication to Jenkins, but standard XXE payloads work reliably.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.10
Vendor Advisory: https://www.jenkins.io/security/advisory/2023-03-21/#SECURITY-2925
Restart Required: Yes
Instructions:
1. Access Jenkins web interface as administrator. 2. Navigate to Manage Jenkins > Manage Plugins. 3. Update Crap4J Plugin to version 0.10 or later. 4. Restart Jenkins service.
🔧 Temporary Workarounds
Disable Crap4J Plugin
allTemporarily disable the vulnerable plugin until patching is possible
# Access Jenkins web UI > Manage Jenkins > Manage Plugins > Installed
# Find Crap4J Plugin and click 'Disable'
Remove Crap4J Plugin
allCompletely uninstall the vulnerable plugin
# Access Jenkins web UI > Manage Jenkins > Manage Plugins > Installed
# Find Crap4J Plugin and click 'Uninstall'
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Jenkins from sensitive systems
- Apply strict file system permissions to limit what files Jenkins can access
🔍 How to Verify
Check if Vulnerable:
Check Jenkins plugin manager for Crap4J Plugin version 0.9 or earlierCheck Version:
# From Jenkins web UI: Manage Jenkins > Manage Plugins > Installed > Crap4J PluginVerify Fix Applied:
Verify Crap4J Plugin version is 0.10 or later in plugin manager📡 Detection & Monitoring
Log Indicators:
- Unusual XML parsing errors in Jenkins logs
- File access patterns from Jenkins process to sensitive locations
Network Indicators:
- HTTP requests with XML payloads containing external entity references
- Outbound connections from Jenkins to unexpected external systems
SIEM Query:
source="jenkins.log" AND ("XXE" OR "external entity" OR "DOCTYPE")