CVE-2025-64138
📋 TL;DR
A CSRF vulnerability in Jenkins Start Windocks Containers Plugin allows attackers to trick authenticated users into connecting Jenkins to attacker-controlled URLs. This affects Jenkins administrators using the vulnerable plugin version. Attackers could redirect Jenkins to malicious endpoints.
💻 Affected Systems
- Jenkins Start Windocks Containers Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could redirect Jenkins to malicious container registries, potentially leading to supply chain attacks, credential theft, or deployment of compromised containers.
Likely Case
Attackers could redirect Jenkins to attacker-controlled endpoints, causing failed builds, service disruption, or data exfiltration from Jenkins.
If Mitigated
With CSRF protection enabled and proper network segmentation, impact is limited to failed connections to external URLs.
🎯 Exploit Status
Exploitation requires social engineering to trick authenticated users. No authentication bypass needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 1.5 or later
Vendor Advisory: https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3531
Restart Required: No
Instructions:
1. Update Jenkins Start Windocks Containers Plugin to version 1.5 or later via Jenkins Plugin Manager. 2. No Jenkins restart required. 3. Verify plugin version in Manage Jenkins > Manage Plugins.
🔧 Temporary Workarounds
Enable CSRF Protection
allEnsure Jenkins global security has CSRF protection enabled
Navigate to Manage Jenkins > Configure Global Security > Enable 'Prevent Cross Site Request Forgery exploits'
Restrict Plugin Access
allLimit plugin usage to trusted administrators only
Use Jenkins Role-Based Authorization Strategy to restrict plugin configuration to specific roles
🧯 If You Can't Patch
- Disable or remove the Start Windocks Containers Plugin if not needed
- Implement network segmentation to restrict Jenkins server's outbound connections
🔍 How to Verify
Check if Vulnerable:
Check plugin version in Manage Jenkins > Manage Plugins > Installed tab. Look for 'Start Windocks Containers Plugin' version 1.4 or earlier.Check Version:
curl -s http://jenkins-host/pluginManager/api/json?depth=1 | grep -o '"shortName":"start-windocks-containers","version":"[^"]*"'Verify Fix Applied:
Verify plugin version is 1.5 or later in Manage Jenkins > Manage Plugins > Installed tab.📡 Detection & Monitoring
Log Indicators:
- Unusual connection attempts to external URLs in Jenkins logs
- Failed container start attempts with unexpected URLs
Network Indicators:
- Jenkins server making unexpected outbound connections to unfamiliar domains/IPs
SIEM Query:
source="jenkins.log" AND ("start-windocks" OR "windocks") AND ("connection failed" OR "unexpected URL")