CVE-2023-41933
📋 TL;DR
This vulnerability in Jenkins Job Configuration History Plugin allows attackers to perform XML External Entity (XXE) attacks by exploiting improper XML parser configuration. Attackers can read arbitrary files from the Jenkins controller file system, potentially exposing sensitive data. All Jenkins instances using affected plugin versions are vulnerable.
💻 Affected Systems
- Jenkins Job Configuration History Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of Jenkins controller file system, allowing reading of sensitive files like credentials, configuration files, and source code, potentially leading to further system compromise.
Likely Case
Unauthorized reading of sensitive files from Jenkins controller, potentially exposing credentials, configuration data, or other sensitive information stored on the server.
If Mitigated
Limited impact with proper network segmentation and file system permissions, but still potential for information disclosure from accessible files.
🎯 Exploit Status
Exploitation requires authenticated access to Jenkins, but XXE attacks are well-documented and relatively easy to execute once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1227.v7a_79fc4dc01f_1 or later
Vendor Advisory: https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3235
Restart Required: Yes
Instructions:
1. Update Jenkins Job Configuration History Plugin to version 1227.v7a_79fc4dc01f_1 or later via Jenkins Plugin Manager. 2. Restart Jenkins to apply the update. 3. Verify the plugin version in Jenkins plugin management interface.
🔧 Temporary Workarounds
Disable vulnerable plugin
allTemporarily disable the Job Configuration History Plugin until patching is possible
Navigate to Jenkins > Manage Jenkins > Manage Plugins > Installed tab > Find 'Job Configuration History' > Click 'Disable'
Restrict file system permissions
linuxLimit file system access to Jenkins service account to reduce potential impact
chmod 700 /var/lib/jenkins
chown -R jenkins:jenkins /var/lib/jenkins
🧯 If You Can't Patch
- Disable the Job Configuration History Plugin immediately
- Implement strict network segmentation to isolate Jenkins from sensitive systems
🔍 How to Verify
Check if Vulnerable:
Check plugin version in Jenkins: Manage Jenkins > Manage Plugins > Installed tab > Find 'Job Configuration History' and check version numberCheck Version:
grep 'Job Configuration History' /var/lib/jenkins/plugins/jobConfigHistory/META-INF/MANIFEST.MF | grep 'Plugin-Version'Verify Fix Applied:
Verify plugin version is 1227.v7a_79fc4dc01f_1 or later in Jenkins plugin management interface📡 Detection & Monitoring
Log Indicators:
- Unusual XML parsing errors in Jenkins logs
- Multiple failed authentication attempts followed by XML-related requests
- File read operations from unexpected locations
Network Indicators:
- XML payloads containing external entity declarations in HTTP requests to Jenkins
- Outbound connections from Jenkins to external entities during XML processing
SIEM Query:
source="jenkins.log" AND ("XXE" OR "external entity" OR "DOCTYPE" OR "ENTITY")