CVE-2025-5806
📋 TL;DR
The Jenkins Gatling Plugin 136.vb_9009b_3d33a_e has a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into Gatling reports. This bypasses Jenkins' Content-Security-Policy protection, affecting users who can modify report content. Jenkins administrators and users with report modification privileges are at risk.
💻 Affected Systems
- Jenkins Gatling Plugin
📦 What is this software?
Gatling by Jenkins
⚠️ Risk & Real-World Impact
Worst Case
An attacker with report modification privileges could execute arbitrary JavaScript in the context of Jenkins administrators, potentially leading to session hijacking, credential theft, or complete system compromise.
Likely Case
Authenticated users with report editing capabilities could inject malicious scripts that execute when administrators view reports, leading to session compromise or unauthorized actions.
If Mitigated
With proper access controls limiting who can modify reports, the impact is reduced to authorized users only, though they could still exploit the vulnerability.
🎯 Exploit Status
Exploitation requires authenticated access with report modification permissions; the vulnerability is in how reports are served, bypassing CSP protections.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to Gatling Plugin version 137.vb_9009b_3d33a_e or later
Vendor Advisory: https://www.jenkins.io/security/advisory/2025-06-06/#SECURITY-3588
Restart Required: Yes
Instructions:
1. Access Jenkins Update Center. 2. Navigate to Manage Jenkins > Manage Plugins. 3. Find Gatling Plugin and update to version 137.vb_9009b_3d33a_e or later. 4. Restart Jenkins after update.
🔧 Temporary Workarounds
Restrict Report Modification Permissions
allLimit which users can create or modify Gatling reports to reduce attack surface.
Configure Jenkins role-based access control to restrict 'Job/Configure' and 'Job/Build' permissions for Gatling projects
🧯 If You Can't Patch
- Disable or uninstall the Gatling Plugin if not required
- Implement strict network segmentation to isolate Jenkins from sensitive systems
🔍 How to Verify
Check if Vulnerable:
Check Jenkins plugin manager for Gatling Plugin version; if version is 136.vb_9009b_3d33a_e or earlier, the system is vulnerable.Check Version:
Navigate to Manage Jenkins > Manage Plugins > Installed tab and check Gatling Plugin versionVerify Fix Applied:
Verify Gatling Plugin version is 137.vb_9009b_3d33a_e or later in Jenkins plugin manager.📡 Detection & Monitoring
Log Indicators:
- Unusual modifications to Gatling report files
- JavaScript injection patterns in report content
Network Indicators:
- Unexpected HTTP requests from Jenkins to external domains triggered by report viewing
SIEM Query:
source="jenkins.log" AND ("Gatling" AND "report") AND ("script" OR "javascript" OR "<script>")