CVE-2025-64140
📋 TL;DR
The Jenkins Azure CLI Plugin vulnerability allows attackers with Item/Configure permission to execute arbitrary shell commands on the Jenkins controller. This occurs because the plugin fails to restrict command execution, enabling remote code execution. Organizations using Jenkins with this plugin are affected.
💻 Affected Systems
- Jenkins Azure CLI Plugin
📦 What is this software?
Azure Cli by Jenkins
⚠️ Risk & Real-World Impact
Worst Case
Full compromise of Jenkins controller leading to lateral movement, data exfiltration, and deployment of persistent backdoors across connected systems.
Likely Case
Attackers with Item/Configure permission gain shell access to Jenkins controller, potentially compromising build pipelines, stealing credentials, and accessing sensitive data.
If Mitigated
With proper access controls and network segmentation, impact limited to isolated Jenkins instance without lateral movement capabilities.
🎯 Exploit Status
Exploitation requires Item/Configure permission; trivial for authenticated attackers with appropriate privileges.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.10 or later
Vendor Advisory: https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3538
Restart Required: Yes
Instructions:
1. Update Jenkins Azure CLI Plugin to version 0.10 or later via Jenkins Plugin Manager
2. Restart Jenkins instance
3. Verify plugin version in Manage Jenkins > Manage Plugins
🔧 Temporary Workarounds
Remove Azure CLI Plugin
allUninstall vulnerable plugin if Azure CLI functionality is not required
Manage Jenkins > Manage Plugins > Installed > Azure CLI Plugin > Uninstall
Restrict Item/Configure Permissions
allTighten access controls to limit users with Item/Configure permission
Manage Jenkins > Configure Global Security > Authorization > Restrict permissions
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Jenkins controller from sensitive systems
- Enforce least privilege access controls and regularly audit users with Item/Configure permission
🔍 How to Verify
Check if Vulnerable:
Check plugin version in Manage Jenkins > Manage Plugins > Installed > Azure CLI PluginCheck Version:
Check Jenkins web interface or plugin directory for azure-cli.jpi versionVerify Fix Applied:
Verify Azure CLI Plugin version is 0.10 or higher in plugin manager📡 Detection & Monitoring
Log Indicators:
- Unusual Azure CLI plugin activity
- Shell command execution from Jenkins processes
- Unauthorized process creation on Jenkins host
Network Indicators:
- Unexpected outbound connections from Jenkins controller
- Command and control traffic patterns
SIEM Query:
source="jenkins.log" AND ("Azure CLI" OR "azure-cli") AND (command OR exec OR shell)