CVE-2025-64142
📋 TL;DR
The Jenkins Nexus Task Runner Plugin before version 0.9.3 has a missing permission check vulnerability. Attackers with Overall/Read permission can force the plugin to connect to attacker-controlled URLs using attacker-specified credentials, potentially leading to credential theft or server-side request forgery. This affects Jenkins instances using the vulnerable plugin version.
💻 Affected Systems
- Jenkins Nexus Task Runner Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal credentials from Jenkins, perform server-side request forgery to internal systems, or use Jenkins as a pivot point for further attacks.
Likely Case
Attackers with read access could exfiltrate credentials or make unauthorized requests to internal systems, potentially accessing sensitive Jenkins data.
If Mitigated
With proper access controls limiting Overall/Read permissions, impact is reduced to authorized users only.
🎯 Exploit Status
Requires attacker to have Overall/Read permission; exploitation involves crafting malicious requests to the plugin endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.9.3
Vendor Advisory: https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3550
Restart Required: No
Instructions:
1. Access Jenkins plugin manager. 2. Update Nexus Task Runner Plugin to version 0.9.3 or later. 3. No restart required.
🔧 Temporary Workarounds
Restrict Overall/Read Permissions
allLimit Overall/Read permissions to only trusted administrators to reduce attack surface.
Navigate to Jenkins > Manage Jenkins > Configure Global Security > Authorization
Disable Plugin
allTemporarily disable the Nexus Task Runner Plugin if not required.
Navigate to Jenkins > Manage Jenkins > Manage Plugins > Installed > Nexus Task Runner Plugin > Disable
🧯 If You Can't Patch
- Restrict Overall/Read permissions to minimal set of users.
- Monitor Jenkins logs for suspicious plugin activity.
🔍 How to Verify
Check if Vulnerable:
Check plugin version in Jenkins > Manage Jenkins > Manage Plugins > Installed > Nexus Task Runner Plugin.Check Version:
curl -s http://jenkins-host/pluginManager/api/json?depth=1 | grep -o '"shortName":"nexus-task-runner","version":"[^"]*"'Verify Fix Applied:
Verify plugin version is 0.9.3 or later in plugin manager.📡 Detection & Monitoring
Log Indicators:
- Unusual requests to /nexus-task-runner/ endpoints
- Failed authentication attempts from unexpected IPs
Network Indicators:
- Outbound connections from Jenkins to unexpected external URLs
SIEM Query:
source="jenkins.log" AND "nexus-task-runner" AND ("POST" OR "GET") AND NOT "status=200"