CVE-2013-6373

Vulnerability

The Exclusion plugin before version 0.9 for Jenkins does not properly restrict access to resource locks managed by the plugin's administration panel. The AdministrationPanel class, which is exposed as a RootAction, was missing permission checks before listing or releasing resources. This allows any remote authenticated user, regardless of their actual permissions, to call the release and list endpoints. The fix adds a StaplerProxy implementation that checks for the Jenkins.ADMINISTER permission before processing any request [4].

Exploitation

An attacker needs only a valid Jenkins login (any level of access). No special privileges are required. The attacker can navigate to the Exclusion plugin's administration panel endpoint and use the "Release resource" button or directly call the corresponding doRelease or doList stapler methods. The release action is performed via a combo box that lists currently allocated resources; the attacker can select any resource and trigger release by clicking the button [2][3].

Impact

A successful exploit allows an attacker to release resource locks that are held by running jobs. This can cause resource conflicts, potentially leading to denial of service or race conditions where jobs that depend on exclusive access to a shared resource (defined by resource names used as semaphores) may execute concurrently, breaking the exclusion guarantee [2][3]. The vulnerability does not allow full remote code execution or data leakage, but it undermines the core purpose of the plugin.

Mitigation

The plugin version 0.9 contains the fix, as evidenced by the commit that added StaplerProxy and the Jenkins.ADMINISTER permission check [4]. Users should update to version 0.9 or later. No workaround is available if the plugin is installed and enabled; upgrading is the only solution. The plugin is now in adoption status and may not receive further updates [2], but version 0.9 addresses the issue.