CVE-2023-37964
📋 TL;DR
This CSRF vulnerability in Jenkins ElasticBox CI Plugin allows attackers to trick authenticated users into unknowingly connecting Jenkins to attacker-controlled URLs using stolen credential IDs. This could expose sensitive credentials stored in Jenkins. Affects Jenkins instances with ElasticBox CI Plugin 5.0.1 or earlier installed.
💻 Affected Systems
- Jenkins ElasticBox CI Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers capture all credentials stored in Jenkins, potentially gaining access to production systems, databases, cloud services, and other infrastructure.
Likely Case
Attackers capture some credentials, leading to unauthorized access to connected systems and potential data exfiltration.
If Mitigated
With proper CSRF protections and credential access controls, impact is limited to potential connection attempts to attacker URLs.
🎯 Exploit Status
Exploitation requires social engineering to trick authenticated users into visiting malicious pages. Credential IDs must be obtained separately.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.0.2 or later
Vendor Advisory: https://www.jenkins.io/security/advisory/2023-07-12/#SECURITY-3131
Restart Required: Yes
Instructions:
1. Update Jenkins ElasticBox CI Plugin to version 5.0.2 or later via Jenkins Plugin Manager. 2. Restart Jenkins after update. 3. Verify plugin version in Manage Jenkins > Manage Plugins.
🔧 Temporary Workarounds
Disable ElasticBox CI Plugin
allTemporarily disable the vulnerable plugin if immediate patching is not possible.
Navigate to Manage Jenkins > Manage Plugins > Installed tab, find ElasticBox CI Plugin, click Disable
Implement CSRF Protection
allEnsure Jenkins CSRF protection is enabled and properly configured.
Check Manage Jenkins > Configure Global Security > Enable CSRF Protection
🧯 If You Can't Patch
- Restrict network access to Jenkins to trusted users only
- Implement strict credential access controls and monitoring
🔍 How to Verify
Check if Vulnerable:
Check Jenkins plugin version: Manage Jenkins > Manage Plugins > Installed tab, find ElasticBox CI Plugin, check if version is 5.0.1 or earlier.Check Version:
No direct CLI command; check via Jenkins web interface or examine $JENKINS_HOME/plugins/elasticbox-ci/META-INF/MANIFEST.MFVerify Fix Applied:
Verify plugin version is 5.0.2 or later in Manage Jenkins > Manage Plugins > Installed tab.📡 Detection & Monitoring
Log Indicators:
- Unexpected connections to external URLs via ElasticBox plugin
- Failed authentication attempts using stolen credentials
Network Indicators:
- Outbound connections from Jenkins to unknown or suspicious URLs
SIEM Query:
source="jenkins.log" AND ("elasticbox" OR "ElasticBox CI") AND ("connection" OR "credential")