CVE-2023-37957
📋 TL;DR
A CSRF vulnerability in Jenkins Pipeline restFul API Plugin 0.11 and earlier allows attackers to trick authenticated users into unknowingly connecting Jenkins to attacker-controlled URLs. This can capture newly generated JCLI tokens, potentially compromising Jenkins security. Affects Jenkins instances with the vulnerable plugin installed.
💻 Affected Systems
- Jenkins Pipeline restFul API Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain administrative access to Jenkins, execute arbitrary code, steal credentials, and compromise the entire CI/CD pipeline.
Likely Case
Attackers capture JCLI tokens to perform unauthorized Jenkins operations, potentially modifying pipelines, accessing secrets, or deploying malicious code.
If Mitigated
With proper CSRF protections and network segmentation, impact is limited to token capture without further exploitation.
🎯 Exploit Status
Exploitation requires tricking authenticated users into visiting malicious pages.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Pipeline restFul API Plugin 0.12 or later
Vendor Advisory: https://www.jenkins.io/security/advisory/2023-07-12/#SECURITY-3126
Restart Required: Yes
Instructions:
1. Update Jenkins Pipeline restFul API Plugin to version 0.12 or later via Jenkins Plugin Manager. 2. Restart Jenkins to apply the update.
🔧 Temporary Workarounds
Disable vulnerable plugin
allTemporarily disable the Pipeline restFul API Plugin if immediate patching isn't possible.
java -jar jenkins-cli.jar -s http://jenkins-url/ disable-plugin pipeline-restful-api
Enable CSRF protection
allEnsure Jenkins CSRF protection is enabled in global security settings.
🧯 If You Can't Patch
- Restrict network access to Jenkins admin interfaces
- Implement strict SameSite cookie policies and Content Security Policy headers
🔍 How to Verify
Check if Vulnerable:
Check Jenkins plugin manager for Pipeline restFul API Plugin version 0.11 or earlier.Check Version:
java -jar jenkins-cli.jar -s http://jenkins-url/ list-plugins | grep pipeline-restful-apiVerify Fix Applied:
Verify Pipeline restFul API Plugin version is 0.12 or later in Jenkins plugin manager.📡 Detection & Monitoring
Log Indicators:
- Unexpected JCLI token generation
- Unusual API connections to external URLs
Network Indicators:
- Outbound connections from Jenkins to unknown domains on port 80/443
SIEM Query:
source="jenkins.log" AND "JCLI token" AND "generated"