CVE-2023-37946
📋 TL;DR
The Jenkins OpenShift Login Plugin vulnerability allows session fixation attacks where previous sessions aren't invalidated upon new login. This enables attackers to hijack user sessions by obtaining or predicting session IDs. Affects Jenkins instances using the OpenShift Login Plugin for authentication.
💻 Affected Systems
- Jenkins OpenShift Login Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could hijack administrator sessions, gaining full control over Jenkins to execute arbitrary code, steal credentials, modify configurations, or deploy malicious builds.
Likely Case
Attackers hijack user sessions to access sensitive build data, modify job configurations, or escalate privileges within the Jenkins environment.
If Mitigated
With proper network segmentation and access controls, impact is limited to the Jenkins instance itself without lateral movement to other systems.
🎯 Exploit Status
Exploitation requires the attacker to obtain or predict a valid session ID, which can be done through various session fixation techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1.0.228.vc7a_0b_0c3d26 or later
Vendor Advisory: https://www.jenkins.io/security/advisory/2023-07-12/#SECURITY-2998
Restart Required: Yes
Instructions:
1. Update Jenkins OpenShift Login Plugin to version 1.1.0.228.vc7a_0b_0c3d26 or later via Jenkins Plugin Manager. 2. Restart Jenkins service. 3. Verify plugin version in Manage Jenkins > Plugin Manager.
🔧 Temporary Workarounds
Disable OpenShift Login Plugin
allTemporarily disable the vulnerable plugin until patching is possible
Navigate to Manage Jenkins > Plugin Manager > Installed tab, find 'OpenShift Login Plugin', click 'Disable'
Implement Session Timeout
allReduce session timeout duration to limit exposure window
In Jenkins configuration, set 'Session timeout' to a lower value (e.g., 30 minutes)
🧯 If You Can't Patch
- Restrict network access to Jenkins to trusted IPs only
- Implement multi-factor authentication for Jenkins logins
🔍 How to Verify
Check if Vulnerable:
Check plugin version in Jenkins: Manage Jenkins > Plugin Manager > Installed tab, find 'OpenShift Login Plugin' and check version number.Check Version:
Jenkins web interface: Manage Jenkins > Plugin Manager > Installed tabVerify Fix Applied:
Verify plugin version is 1.1.0.228.vc7a_0b_0c3d26 or later in Plugin Manager, then test login to confirm new session invalidates previous one.📡 Detection & Monitoring
Log Indicators:
- Multiple successful logins from same user in quick succession
- Session ID reuse across different IP addresses
- Unusual authentication patterns
Network Indicators:
- Multiple authentication requests with same session cookies
- Session cookies being used from unexpected locations
SIEM Query:
source="jenkins.log" AND ("session" AND "login" AND "multiple" OR "concurrent")