Listen to this Post
In Jenkins, build authorization tokens are used to authenticate remote build triggers via HTTP requests. These tokens are intended to be secret, but in affected versions, they are displayed in plain text on the job configuration form in the web interface. When a user with access to configure jobs views this page, the token is visible as clear text, unlike password fields which are masked. This exposure allows anyone with view permissions to the job configuration to observe and copy the token. Attackers can obtain this token through direct access, such as compromised user accounts, or indirectly via shoulder surfing or screenshot captures. Once captured, the token can be used to trigger builds remotely without authorization by sending HTTP POST requests to the Jenkins server. The vulnerability stems from the lack of input masking for the token field in the UI. It affects Jenkins instances where job configuration pages are accessible to users with minimal privileges. The plaintext storage in configuration files exacerbates the risk, but the primary vector is the web interface display. This can lead to unauthorized build execution, potentially causing resource exhaustion, data leakage, or malicious code execution depending on build steps. The issue is particularly critical in CI/CD environments where build tokens grant significant operational control. Fixes involve updating to patched versions that mask the token field on the configuration form.
Platform: Jenkins
Version: >=2.529<2.541, <2.528.3
Vulnerability: Token plaintext disclosure
Severity: Moderate
Date: Dec 10, 2025
Prediction: Patched in 2.541, 2.528.3
What Undercode Say:
Analytics:
!/bin/bash
Check Jenkins version from HTTP headers
curl -I http://jenkins-server/ | grep -i “X-Jenkins”
List jobs to identify targets
curl -s http://jenkins-server/api/json | jq ‘.jobs[].name’
Exploit if token is known (replace placeholders)
curl -X POST http://jenkins-server/job/Example/build?token=LEAKED_TOKEN
Verify token masking on configuration page
curl -s http://jenkins-server/job/Example/configure | grep -o “authorizationToken”
How Exploit:
Access job configuration page, capture plaintext token, trigger unauthorized builds via HTTP POST.
Protection from this CVE:
Upgrade to patched versions, restrict configuration access, use authentication controls.
Impact:
Unauthorized build triggers, resource abuse, potential code execution.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
