CVE-2025-64133
📋 TL;DR
A CSRF vulnerability in Jenkins Extensible Choice Parameter Plugin allows attackers to trick authenticated users into executing sandboxed Groovy code. This affects Jenkins administrators and users with configuration permissions who visit malicious web pages while logged into Jenkins.
💻 Affected Systems
- Jenkins Extensible Choice Parameter Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could execute arbitrary Groovy code within Jenkins sandbox constraints, potentially leading to data exposure, configuration changes, or further privilege escalation.
Likely Case
Attackers could modify job configurations, steal credentials stored in Jenkins, or disrupt CI/CD pipelines through unauthorized changes.
If Mitigated
With proper CSRF protections and network segmentation, impact is limited to authenticated users who interact with malicious content while logged in.
🎯 Exploit Status
Exploitation requires social engineering to trick authenticated users into visiting malicious web pages.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 240.v5f5c278708cf or later
Vendor Advisory: https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3583
Restart Required: No
Instructions:
1. Navigate to Jenkins Manage Jenkins > Plugin Manager. 2. Check for updates to Extensible Choice Parameter Plugin. 3. Update to version 240.v5f5c278708cf or later. 4. No restart required.
🔧 Temporary Workarounds
Enable CSRF Protection
allEnsure Jenkins CSRF protection is enabled in global security settings
Restrict Plugin Access
allLimit configuration permissions to trusted administrators only
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Jenkins from untrusted networks
- Educate users about CSRF risks and safe browsing practices while logged into Jenkins
🔍 How to Verify
Check if Vulnerable:
Check plugin version in Jenkins Manage Jenkins > Plugin Manager > Installed tabCheck Version:
curl -s http://jenkins-host/pluginManager/api/json?depth=1 | grep -o '"shortName":"extensible-choice-parameter","version":"[^"]*"'Verify Fix Applied:
Verify Extensible Choice Parameter Plugin version is 240.v5f5c278708cf or later📡 Detection & Monitoring
Log Indicators:
- Unusual Groovy script execution in Jenkins logs
- Unexpected configuration changes to Extensible Choice Parameter
Network Indicators:
- CSRF token validation failures in web server logs
- Unexpected POST requests to Jenkins configuration endpoints
SIEM Query:
source="jenkins.log" AND ("extensible-choice-parameter" OR "CSRF") AND ("error" OR "unauthorized")