CVE-2023-35149

Vulnerability

A missing permission check in Jenkins Digital.ai App Management Publisher Plugin 2.6 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL, capturing credentials stored in Jenkins [1][2]. The plugin fails to properly verify that a user has the necessary permissions before initiating an outbound connection, enabling unauthorized credential exfiltration.

Exploitation

An attacker needs only the default Overall/Read permission, which is typically granted to most authenticated users. By providing a malicious URL, the attacker can trigger the plugin to send a request containing captured Jenkins credentials to an external server under their control [3].

Impact

Successful exploitation results in the compromise of stored credentials, which could include passwords, API tokens, or other sensitive material. This could lead to further unauthorized access to Jenkins resources and connected systems.

Mitigation

At the time of publication (2023-06-14), the plugin maintainer had not yet released a fix. As a workaround, administrators are advised to restrict Overall/Read permissions to trusted users only or consider disabling the plugin if not necessary [1][3]. The vulnerability is listed as unresolved per the Jenkins security advisory.