CVE-2025-64134
📋 TL;DR
Jenkins JDepend Plugin 1.3.1 and earlier contains an XML external entity (XXE) vulnerability due to an outdated JDepend Maven Plugin dependency. This allows attackers to read arbitrary files from the Jenkins controller file system and potentially perform server-side request forgery. All Jenkins instances using the vulnerable plugin versions are affected.
💻 Affected Systems
- Jenkins JDepend Plugin
📦 What is this software?
Jdepend by Jenkins
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of Jenkins controller file system, including reading sensitive credentials, configuration files, and potentially executing arbitrary code through SSRF chaining.
Likely Case
Unauthorized reading of sensitive files from Jenkins controller, potentially exposing credentials, source code, or configuration data.
If Mitigated
Limited impact if proper network segmentation and file system permissions restrict access to sensitive files.
🎯 Exploit Status
Exploitation requires authenticated access to Jenkins with permission to configure or trigger builds using the JDepend Plugin.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.3.2 or later
Vendor Advisory: https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-2936
Restart Required: Yes
Instructions:
1. Update Jenkins JDepend Plugin to version 1.3.2 or later via Jenkins Plugin Manager
2. Restart Jenkins instance
3. Verify plugin version in Manage Jenkins > Manage Plugins
🔧 Temporary Workarounds
Disable JDepend Plugin
allTemporarily disable the vulnerable plugin until patching is possible
Navigate to Manage Jenkins > Manage Plugins > Installed
Find JDepend Plugin and click Disable
Remove JDepend Plugin
allCompletely remove the vulnerable plugin
Navigate to Manage Jenkins > Manage Plugins > Installed
Find JDepend Plugin and click Uninstall
🧯 If You Can't Patch
- Restrict Jenkins user permissions to only necessary build configurations
- Implement network segmentation to isolate Jenkins controller from sensitive systems
🔍 How to Verify
Check if Vulnerable:
Check Jenkins plugin version: Navigate to Manage Jenkins > Manage Plugins > Installed, find JDepend Plugin and verify version is 1.3.1 or earlierCheck Version:
curl -s http://jenkins-host/pluginManager/api/json?depth=1 | grep -o '"shortName":"jdepend","version":"[^"]*"'Verify Fix Applied:
Verify JDepend Plugin version is 1.3.2 or later in Manage Jenkins > Manage Plugins > Installed📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns in Jenkins logs
- XML parsing errors related to external entities
- Failed attempts to access restricted files
Network Indicators:
- Outbound HTTP requests from Jenkins to internal systems not typically accessed
SIEM Query:
source="jenkins.log" AND ("XXE" OR "external entity" OR "file://" OR "http://localhost")