CVE-2017-2649

Vulnerability

The Jenkins Active Directory Plugin up to and including version 2.2 did not verify certificates of the Active Directory server when using LDAPS, allowing an attacker to impersonate the server through a Man-in-the-Middle (MitM) attack [1], [2]. This affects all installations where the plugin is configured to connect to Active Directory over LDAPS without proper certificate validation.

Exploitation

An attacker with network access to the communication path between Jenkins and the Active Directory server can perform a Man-in-the-Middle attack by presenting a self-signed or otherwise invalid certificate. No authentication is required, and the attacker does not need special privileges on Jenkins or the Active Directory server [1], [2].

Impact

A successful MitM attack allows the attacker to intercept or modify authentication traffic, potentially capturing credentials or impersonating the Active Directory server. This could lead to unauthorized access to Jenkins and the Active Directory domain. The attacker gains a network-level position that compromises the confidentiality and integrity of the authentication flow [1], [2].

Mitigation

The vulnerability is fixed in Active Directory Plugin version 2.3, released on 2017-03-20 [2]. Users should update to this version or later. No workaround is documented, and the plugin is under active maintenance. This CVE is not listed on the Known Exploited Vulnerabilities (KEV) catalog.