CVE-2025-64143
📋 TL;DR
The Jenkins OpenShift Pipeline Plugin 1.0.57 and earlier stores authorization tokens unencrypted in job configuration files, allowing users with Item/Extended Read permission or filesystem access to view sensitive credentials. This affects Jenkins instances using the vulnerable plugin version.
💻 Affected Systems
- Jenkins OpenShift Pipeline Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers with appropriate permissions could steal OpenShift authorization tokens, potentially gaining unauthorized access to Kubernetes/OpenShift clusters and performing malicious operations.
Likely Case
Internal users with Item/Extended Read permission could inadvertently or intentionally view and misuse sensitive OpenShift credentials stored in job configurations.
If Mitigated
With strict access controls and proper permission management, only trusted administrators could access the sensitive data, limiting exposure.
🎯 Exploit Status
Exploitation requires Item/Extended Read permission on Jenkins jobs or direct access to the Jenkins controller filesystem. No authentication bypass is involved.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.58 or later
Vendor Advisory: https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3553
Restart Required: No
Instructions:
1. Update Jenkins OpenShift Pipeline Plugin to version 1.0.58 or later via Jenkins Plugin Manager. 2. No Jenkins restart required. 3. Existing job configurations will be automatically secured upon next configuration save.
🔧 Temporary Workarounds
Restrict Item/Extended Read Permissions
allLimit users with Item/Extended Read permission to only trusted administrators to prevent unauthorized viewing of job configuration files.
Configure via Jenkins Manage Jenkins > Configure Global Security > Authorization
Secure Jenkins Controller Filesystem
allRestrict filesystem access to Jenkins controller to prevent unauthorized users from reading config.xml files directly.
Use OS-level file permissions: chmod 600 config.xml files, restrict directory access
🧯 If You Can't Patch
- Review and audit all users with Item/Extended Read permission, removing unnecessary access.
- Implement strict filesystem access controls on Jenkins controller to prevent unauthorized config.xml file access.
🔍 How to Verify
Check if Vulnerable:
Check Jenkins plugin manager for OpenShift Pipeline Plugin version. If version is 1.0.57 or earlier, the instance is vulnerable.Check Version:
Navigate to Jenkins > Manage Jenkins > Plugin Manager > Installed plugins, find OpenShift Pipeline PluginVerify Fix Applied:
Verify plugin version is 1.0.58 or later in Jenkins Plugin Manager. Check that authorization tokens in job config.xml files are no longer stored in plain text.📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to job configuration files, multiple failed permission checks for Item/Extended Read
Network Indicators:
- Unusual API calls to OpenShift/Kubernetes clusters from Jenkins nodes
SIEM Query:
source="jenkins" AND (event="ACCESS_DENIED" OR event="PERMISSION_CHECK_FAILED") AND user_privilege="Item/ExtendedRead"