CVE-2025-67639
📋 TL;DR
A CSRF vulnerability in Jenkins allows attackers to trick authenticated users into logging into the attacker's Jenkins account. This affects Jenkins 2.540 and earlier, and Jenkins LTS 2.528.2 and earlier. Users with Jenkins accounts who visit malicious websites while authenticated to Jenkins are vulnerable.
💻 Affected Systems
- Jenkins
- Jenkins LTS
📦 What is this software?
Jenkins by Jenkins
Jenkins by Jenkins
⚠️ Risk & Real-World Impact
Worst Case
Attacker gains access to user's Jenkins session, potentially performing actions as the user including modifying jobs, accessing credentials, or escalating privileges.
Likely Case
User inadvertently logs into attacker's Jenkins account, exposing their Jenkins session to the attacker who can perform limited actions depending on the attacker's account permissions.
If Mitigated
No impact if CSRF protections are enabled or users don't visit malicious sites while authenticated.
🎯 Exploit Status
Exploitation requires user interaction with malicious web content while authenticated to Jenkins.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Jenkins 2.541, Jenkins LTS 2.528.3
Vendor Advisory: https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-1166
Restart Required: Yes
Instructions:
1. Backup Jenkins configuration and data. 2. Upgrade to Jenkins 2.541 or Jenkins LTS 2.528.3. 3. Restart Jenkins service. 4. Verify upgrade completed successfully.
🔧 Temporary Workarounds
Enable CSRF Protection
allConfigure Jenkins to use CSRF protection tokens
Configure 'Prevent Cross Site Request Forgery exploits' in Jenkins security settings
Restrict Jenkins Access
allLimit Jenkins access to trusted networks only
Configure firewall rules to restrict Jenkins port access
🧯 If You Can't Patch
- Implement network segmentation to restrict Jenkins access to trusted users only
- Educate users about phishing risks and safe browsing practices
🔍 How to Verify
Check if Vulnerable:
Check Jenkins version in Manage Jenkins > About JenkinsCheck Version:
java -jar jenkins.war --versionVerify Fix Applied:
Verify version is 2.541 or higher for Jenkins, or 2.528.3 or higher for Jenkins LTS📡 Detection & Monitoring
Log Indicators:
- Multiple failed login attempts from same IP
- Unusual user agent strings in access logs
Network Indicators:
- HTTP POST requests to /j_spring_security_check with suspicious referrers
SIEM Query:
source="jenkins.log" AND "POST /j_spring_security_check" AND referer NOT CONTAINS "your-jenkins-domain"