CVE-2023-24434

Vulnerability

Analysis

A cross-site request forgery (CSRF) vulnerability exists in the Jenkins GitHub Pull Request Builder Plugin version 1.42.2 and earlier [1][2]. The root cause is the absence of CSRF protection, enabling an attacker to forge requests on behalf of a legitimate user [1].

Attack

Vector

An attacker can exploit this vulnerability by tricking an authenticated Jenkins user into clicking a crafted link or visiting a malicious page [1]. The attacker must first obtain valid credential IDs through a separate method (e.g., another vulnerability or information disclosure) [2]. With these IDs, a forged request can trigger the plugin to connect to an attacker-controlled URL using those credentials [1][2].

Impact

Successful exploitation allows the attacker to capture credentials stored in Jenkins by redirecting them to an attacker-specified URL [1][2]. The attacker gains unauthorized access to sensitive credentials, which can be used for further attacks within the Jenkins environment [1].

Mitigation

Jenkins has addressed this vulnerability in the GitHub Pull Request Builder Plugin by implementing CSRF protection [1]. Users should upgrade to a version containing the fix to prevent exploitation [1][2].