CVE-2023-37949
📋 TL;DR
This vulnerability in Jenkins Orka by MacStadium Plugin allows attackers with Overall/Read permission to connect to attacker-controlled URLs using stolen credential IDs, potentially exposing sensitive Jenkins credentials. It affects Jenkins instances using the Orka plugin version 1.33 and earlier. Attackers need some level of access but can escalate to credential theft.
💻 Affected Systems
- Jenkins Orka by MacStadium Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of Jenkins credentials leading to lateral movement, data exfiltration, and potential infrastructure takeover.
Likely Case
Credential theft from Jenkins credential store, enabling further attacks on connected systems and services.
If Mitigated
Limited impact due to proper access controls and network segmentation preventing credential exfiltration.
🎯 Exploit Status
Exploitation requires attacker to have Overall/Read permission and access to credential IDs through other means.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.34 or later
Vendor Advisory: https://www.jenkins.io/security/advisory/2023-07-12/#SECURITY-3128
Restart Required: Yes
Instructions:
1. Update Jenkins Orka plugin to version 1.34 or later via Jenkins Plugin Manager
2. Restart Jenkins service
3. Verify plugin version in Manage Jenkins > Manage Plugins
🔧 Temporary Workarounds
Remove Overall/Read permission from untrusted users
allRestrict Overall/Read permission to trusted administrators only
Disable Orka plugin
allTemporarily disable the vulnerable plugin if not required
Manage Jenkins > Manage Plugins > Installed > Orka by MacStadium > Disable
🧯 If You Can't Patch
- Implement strict access controls limiting Overall/Read permission to essential personnel only
- Monitor Jenkins logs for suspicious credential access attempts and network connections to external URLs
🔍 How to Verify
Check if Vulnerable:
Check Jenkins plugin version: Manage Jenkins > Manage Plugins > Installed > Orka by MacStadiumCheck Version:
Check Jenkins web interface or plugin manifest fileVerify Fix Applied:
Verify plugin version is 1.34 or higher in Manage Jenkins > Manage Plugins📡 Detection & Monitoring
Log Indicators:
- Unusual credential access patterns
- Connections to unexpected external URLs from Jenkins
- Failed permission checks in Orka plugin logs
Network Indicators:
- Outbound connections from Jenkins to unfamiliar domains/IPs
- Unusual credential store access patterns
SIEM Query:
source="jenkins" AND (plugin="orka" OR credential_access OR url_connection)