CVE-2024-34146
📋 TL;DR
The Jenkins Git server Plugin vulnerability allows attackers with a previously configured SSH public key but lacking Overall/Read permission to access Git repositories over SSH. This affects Jenkins instances using the Git server Plugin version 114.v068a_c7cc2574 and earlier. Attackers can read repository contents they shouldn't have access to.
💻 Affected Systems
- Jenkins Git server Plugin
📦 What is this software?
Git Server by Jenkins
⚠️ Risk & Real-World Impact
Worst Case
Sensitive source code, credentials, or proprietary information from Git repositories is exfiltrated by unauthorized users.
Likely Case
Unauthorized users with SSH keys access repositories containing internal code or configuration files.
If Mitigated
Minimal impact if SSH key management is strict and repositories contain no sensitive data.
🎯 Exploit Status
Exploitation requires a previously configured SSH public key on the Jenkins instance.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 115.vfec9a_4b_e82c33 or later
Vendor Advisory: https://www.jenkins.io/security/advisory/2024-05-02/#SECURITY-3342
Restart Required: Yes
Instructions:
1. Update Jenkins Git server Plugin to version 115.vfec9a_4b_e82c33 or later via Jenkins Plugin Manager. 2. Restart Jenkins after update.
🔧 Temporary Workarounds
Disable SSH access to Git repositories
allRemove or restrict SSH configuration for Git server Plugin if not required.
Review and remove unnecessary SSH keys
allAudit and remove SSH public keys from Jenkins that are not strictly needed.
🧯 If You Can't Patch
- Restrict SSH access to Jenkins Git server to trusted IPs only.
- Implement network segmentation to isolate Jenkins Git server from untrusted users.
🔍 How to Verify
Check if Vulnerable:
Check Jenkins Plugin Manager for Git server Plugin version. If version is 114.v068a_c7cc2574 or earlier, it is vulnerable.Check Version:
In Jenkins web UI: Manage Jenkins > Plugin Manager > Installed plugins, find 'Git server Plugin'.Verify Fix Applied:
Verify Git server Plugin version is 115.vfec9a_4b_e82c33 or later in Jenkins Plugin Manager.📡 Detection & Monitoring
Log Indicators:
- Unusual SSH access patterns to Jenkins Git repositories from unauthorized users.
Network Indicators:
- SSH connections to Jenkins Git server from unexpected sources.
SIEM Query:
source="jenkins" AND "ssh" AND "git" AND (event="access" OR event="repository")