CVE-2024-34148
📋 TL;DR
The Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier programmatically disables the fix for CVE-2016-3721 when builds are triggered from release tags, allowing parameter injection attacks. This affects Jenkins instances using this specific plugin with vulnerable versions.
💻 Affected Systems
- Jenkins Subversion Partial Release Manager Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could inject arbitrary parameters into Jenkins builds, potentially leading to remote code execution, data exfiltration, or unauthorized system access.
Likely Case
Parameter injection allowing manipulation of build processes, potentially exposing sensitive information or disrupting CI/CD pipelines.
If Mitigated
Limited impact if proper access controls and network segmentation are in place, though parameter injection risks remain.
🎯 Exploit Status
Exploitation requires triggering builds from release tags in the vulnerable plugin configuration.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to Jenkins Subversion Partial Release Manager Plugin version 1.0.2 or later
Vendor Advisory: https://www.jenkins.io/security/advisory/2024-05-02/#SECURITY-3331
Restart Required: Yes
Instructions:
1. Access Jenkins web interface
2. Navigate to Manage Jenkins > Manage Plugins
3. Go to Available tab
4. Search for 'Subversion Partial Release Manager Plugin'
5. Install version 1.0.2 or later
6. Restart Jenkins service
🔧 Temporary Workarounds
Disable vulnerable plugin
linuxTemporarily disable the Subversion Partial Release Manager Plugin until patching is possible
# Stop Jenkins service
sudo systemctl stop jenkins
# Navigate to Jenkins plugins directory
cd /var/lib/jenkins/plugins
# Rename plugin file to disable
sudo mv subversion-partial-release-manager.hpi subversion-partial-release-manager.hpi.disabled
# Restart Jenkins
sudo systemctl start jenkins
🧯 If You Can't Patch
- Restrict access to Jenkins build triggers to authorized users only
- Implement network segmentation to isolate Jenkins from sensitive systems
🔍 How to Verify
Check if Vulnerable:
Check Jenkins plugin manager for Subversion Partial Release Manager Plugin version 1.0.1 or earlierCheck Version:
# Check plugin version via Jenkins CLI or web interfaceVerify Fix Applied:
Verify plugin version is 1.0.2 or later in Jenkins plugin manager📡 Detection & Monitoring
Log Indicators:
- Unusual parameter values in build logs
- Builds triggered from release tags with unexpected parameters
Network Indicators:
- Unusual Jenkins API calls related to build triggering
SIEM Query:
source="jenkins.log" AND "Subversion Partial Release Manager" AND "release tag" AND "build triggered"