CVE-2023-35141
📋 TL;DR
This is a Cross-Site Request Forgery (CSRF) vulnerability in Jenkins where insufficient URL escaping allows attackers to trick authenticated users into sending unauthorized POST requests by opening context menus. It affects Jenkins instances with version 2.399 or earlier, and LTS 2.387.3 or earlier.
💻 Affected Systems
- Jenkins
📦 What is this software?
Jenkins by Jenkins
Jenkins by Jenkins
⚠️ Risk & Real-World Impact
Worst Case
An attacker could perform actions on behalf of authenticated users, potentially modifying configurations, creating/deleting jobs, or executing arbitrary code if combined with other vulnerabilities.
Likely Case
Attackers could trick users into performing unintended administrative actions like modifying job configurations or changing system settings.
If Mitigated
With proper CSRF protection and user awareness, impact is limited to actions within the user's permission scope.
🎯 Exploit Status
Exploitation requires tricking an authenticated user into opening a malicious context menu, making it a client-side attack vector.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Jenkins 2.400, Jenkins LTS 2.387.4
Vendor Advisory: https://www.jenkins.io/security/advisory/2023-06-14/#SECURITY-3135
Restart Required: Yes
Instructions:
1. Backup your Jenkins instance. 2. Upgrade to Jenkins 2.400 or Jenkins LTS 2.387.4 or later. 3. Restart Jenkins service. 4. Verify the upgrade completed successfully.
🔧 Temporary Workarounds
Enable Strict CSRF Protection
allConfigure Jenkins to use strict CSRF protection which may help mitigate some attack vectors.
Set Java system property: -Dhudson.security.csrf.DefaultCrumbIssuer.EXCLUDE_SESSION_ID=true
🧯 If You Can't Patch
- Implement network segmentation to restrict Jenkins access to trusted users only
- Educate users about not clicking suspicious links or context menus in Jenkins
🔍 How to Verify
Check if Vulnerable:
Check Jenkins version via Manage Jenkins > About Jenkins or via CLI with 'java -jar jenkins.war --version'Check Version:
java -jar jenkins.war --versionVerify Fix Applied:
Verify version is 2.400 or higher (or LTS 2.387.4 or higher) and test context menu functionality📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to unexpected endpoints
- Multiple failed context menu load attempts
Network Indicators:
- Unexpected POST requests from authenticated sessions to non-standard endpoints
SIEM Query:
source="jenkins.log" AND "POST" AND "contextMenu" AND status=200