CVE-2018-1000013

Vulnerability

Jenkins Release Plugin version 2.9 and earlier did not require form submissions to be submitted via HTTP POST, allowing Cross-Site Request Forgery (CSRF) attacks. The vulnerability exists in the form action endpoint used to trigger release builds [1].

Exploitation

An attacker can craft a malicious web page or link that, when visited by an authenticated Jenkins user, submits a forged request to the Release Plugin's form action URL. Since the plugin accepted GET requests (or other methods) without CSRF protection, the build is triggered without the victim's consent [2].

Impact

Successful exploitation allows an attacker to trigger release builds on the Jenkins instance. This can lead to unauthorized releases of software, potentially causing supply chain compromise or other downstream harm. The attacker gains the ability to initiate builds with the privileges of the victim user [1].

Mitigation

Jenkins Security Advisory 2018-01-22 states that the fix requires access to the form action URL to use POST only. Users should update the Release Plugin to version 3.0 or later, where this CSRF protection is enforced [2].