CVE-2018-1000174

Vulnerability

An open redirect vulnerability exists in the Jenkins Google Login Plugin, version 1.3 and older, in the GoogleOAuth2SecurityRealm.java file. The plugin does not validate user-supplied redirect URLs after a successful Google OAuth login, allowing attackers to specify an arbitrary URL via a query parameter. This affects all installations using the affected plugin version [1], [2].

Exploitation

An attacker can craft a malicious link that, after a victim successfully authenticates via Google Login in Jenkins, redirects the victim to an arbitrary external URL controlled by the attacker. The attacker only needs to trick a Jenkins user into clicking the crafted link and completing the login process; no additional privileges are required [2].

Impact

Successful exploitation allows the attacker to perform phishing attacks by redirecting victims to malicious sites after login. This can lead to credential theft or other social engineering attacks, as the victim may believe they are still interacting with the legitimate Jenkins instance. The impact is limited to redirecting the user's browser; no Jenkins data is directly exposed [1], [2].

Mitigation

Users should upgrade to Google Login Plugin version 1.4 or later, which fixes the issue by only performing redirects to relative URLs. The fix was included in the 2018-04-16 security advisory [2]. No workarounds are documented; upgrading the plugin is the recommended mitigation.