CVE-2023-49656
📋 TL;DR
The Jenkins MATLAB Plugin 2.11.0 and earlier contains an XML External Entity (XXE) vulnerability due to improper XML parser configuration. This allows attackers to read arbitrary files from the Jenkins controller file system, potentially leading to sensitive information disclosure. All Jenkins instances using the vulnerable MATLAB plugin versions are affected.
💻 Affected Systems
- Jenkins MATLAB Plugin
📦 What is this software?
Matlab by Jenkins
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of Jenkins controller through arbitrary file read, potentially exposing credentials, secrets, and sensitive configuration files, leading to further system compromise.
Likely Case
Unauthorized reading of sensitive files on Jenkins controller, including credentials, SSH keys, and configuration data that could enable lateral movement.
If Mitigated
Limited impact with proper network segmentation and file system permissions, restricting attacker access to non-sensitive files only.
🎯 Exploit Status
Exploitation requires authentication with Overall/Read permission in Jenkins. XXE vulnerabilities are well-understood and frequently exploited.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.12.0
Vendor Advisory: https://www.jenkins.io/security/advisory/2023-11-29/#SECURITY-3193
Restart Required: Yes
Instructions:
1. Update Jenkins MATLAB Plugin to version 2.12.0 or later via Jenkins Plugin Manager. 2. Restart Jenkins instance after update. 3. Verify plugin version in Manage Jenkins > Manage Plugins > Installed tab.
🔧 Temporary Workarounds
Disable MATLAB Plugin
allTemporarily disable the vulnerable plugin if immediate patching is not possible
Navigate to Manage Jenkins > Manage Plugins > Installed tab, find MATLAB Plugin, click Disable
Restrict Jenkins User Permissions
allLimit user access to only necessary permissions to reduce attack surface
Configure Jenkins security matrix to restrict Overall/Read permissions to trusted users only
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Jenkins from sensitive systems
- Apply file system permissions to restrict access to sensitive files on Jenkins controller
🔍 How to Verify
Check if Vulnerable:
Check installed MATLAB plugin version in Jenkins: Manage Jenkins > Manage Plugins > Installed tab, look for MATLAB Plugin versionCheck Version:
Check Jenkins plugin directory for matlab.hpi file version or use Jenkins CLI: java -jar jenkins-cli.jar -s http://jenkins-url/ list-plugins | grep matlabVerify Fix Applied:
Verify MATLAB plugin version is 2.12.0 or higher in Manage Jenkins > Manage Plugins > Installed tab📡 Detection & Monitoring
Log Indicators:
- Unusual XML parsing errors in Jenkins logs
- Multiple failed authentication attempts followed by XML processing requests
- File read operations from unexpected locations
Network Indicators:
- XML payloads containing external entity references in HTTP requests to Jenkins
- Outbound connections from Jenkins to external servers during XML processing
SIEM Query:
source="jenkins.log" AND ("XML" OR "XXE" OR "external entity") AND (error OR warning OR exception)