CVE-2025-67638
📋 TL;DR
Jenkins versions 2.540 and earlier (including LTS 2.528.2 and earlier) expose build authorization tokens in plain text on job configuration forms. This allows attackers with access to these forms to capture tokens and potentially trigger unauthorized builds. Only Jenkins administrators and users with configuration permissions are affected.
💻 Affected Systems
- Jenkins
📦 What is this software?
Jenkins by Jenkins
Jenkins by Jenkins
⚠️ Risk & Real-World Impact
Worst Case
Attackers capture build tokens and trigger malicious builds that could execute arbitrary code, exfiltrate sensitive data, or disrupt CI/CD pipelines.
Likely Case
Attackers with access to job configuration pages capture tokens and trigger unauthorized builds, potentially causing resource exhaustion or pipeline disruption.
If Mitigated
With proper access controls, only authorized users can view configuration pages, limiting exposure to internal threats.
🎯 Exploit Status
Exploitation requires access to job configuration pages. Attackers can simply view the exposed tokens on these forms.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Jenkins 2.541, Jenkins LTS 2.528.3
Vendor Advisory: https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-783
Restart Required: Yes
Instructions:
1. Backup your Jenkins instance. 2. Upgrade to Jenkins 2.541 or Jenkins LTS 2.528.3. 3. Restart Jenkins. 4. Verify the fix by checking that build tokens are now masked on job configuration forms.
🔧 Temporary Workarounds
Restrict access to job configuration
allLimit access to job configuration pages to only trusted administrators using Jenkins' Role-Based Authorization Strategy plugin.
Use alternative authentication methods
allReplace build authorization tokens with other authentication methods like SSH keys or API tokens where possible.
🧯 If You Can't Patch
- Implement strict access controls to limit who can view job configuration pages.
- Regularly rotate build authorization tokens to limit exposure window.
🔍 How to Verify
Check if Vulnerable:
Check Jenkins version via Manage Jenkins > About Jenkins. If version is 2.540 or earlier (or LTS 2.528.2 or earlier), the system is vulnerable.Check Version:
java -jar jenkins.war --versionVerify Fix Applied:
After patching, verify that build tokens are masked (displayed as asterisks) on job configuration forms.📡 Detection & Monitoring
Log Indicators:
- Unauthorized build triggers using captured tokens
- Multiple failed build attempts from unusual sources
Network Indicators:
- Unusual build trigger patterns
- Build requests from unexpected IP addresses
SIEM Query:
source="jenkins" AND (event="BUILD_TRIGGERED" OR event="BUILD_STARTED") AND user="anonymous"