CVE-2025-64139
📋 TL;DR
This vulnerability in Jenkins Start Windocks Containers Plugin allows attackers with Overall/Read permission to connect to arbitrary URLs, potentially enabling SSRF attacks or data exfiltration. It affects Jenkins instances using the vulnerable plugin version.
💻 Affected Systems
- Jenkins Start Windocks Containers Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could connect to internal services, exfiltrate sensitive data, or use the Jenkins instance as a proxy for attacks against other systems.
Likely Case
Information disclosure through SSRF to internal services or metadata endpoints.
If Mitigated
Limited impact if proper network segmentation and permission controls are in place.
🎯 Exploit Status
Exploitation requires authenticated access with Overall/Read permission.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 1.5 or later
Vendor Advisory: https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3531
Restart Required: No
Instructions:
1. Update Jenkins Start Windocks Containers Plugin to version 1.5 or later via Jenkins Plugin Manager. 2. No restart required.
🔧 Temporary Workarounds
Remove plugin
allUninstall the vulnerable plugin if not required
Manage Jenkins > Manage Plugins > Installed > Uninstall Start Windocks Containers Plugin
Restrict permissions
allLimit Overall/Read permission to trusted users only
Manage Jenkins > Configure Global Security > Authorization
🧯 If You Can't Patch
- Implement network segmentation to restrict Jenkins server outbound connections
- Review and minimize users with Overall/Read permission
🔍 How to Verify
Check if Vulnerable:
Check plugin version in Manage Jenkins > Manage Plugins > Installed > Start Windocks Containers PluginCheck Version:
Check Jenkins plugin directory or web interfaceVerify Fix Applied:
Verify plugin version is 1.5 or later in Plugin Manager📡 Detection & Monitoring
Log Indicators:
- Unusual outbound connections from Jenkins server
- Plugin-related errors in Jenkins logs
Network Indicators:
- Unexpected outbound HTTP/HTTPS traffic from Jenkins to unusual destinations
SIEM Query:
source="jenkins" AND (event="plugin_activity" OR url_connection="*" AND user_permission="Overall/Read")