CVE-2023-41941

Vulnerability

Overview

CVE-2023-41941 is a missing permission check vulnerability in the Jenkins AWS CodeCommit Trigger Plugin version 3.0.12 and earlier [1]. The plugin fails to verify proper permissions when exposing credential ID values, which should be restricted to users with higher privileges [2].

Exploitation

An attacker can exploit this vulnerability by leveraging the Overall/Read permission, which is typically granted to all authenticated users or even anonymous users in some Jenkins configurations [1][2]. No additional authentication or network access is required beyond access to the Jenkins instance. The attacker can enumerate AWS credential IDs by sending crafted requests to the affected plugin endpoint [1].

Impact

Successful exploitation allows an attacker to obtain AWS credential IDs stored in Jenkins, which are sensitive identifiers that can be used in further attacks targeting AWS environments [1][2]. This information disclosure can facilitate the compromise of associated AWS secrets or access keys if an attacker gains other privileges [2].

Mitigation

As of the advisory date (2023-09-06), the AWS CodeCommit Trigger Plugin has not been updated to fix this issue [2]. Users should consider disabling the plugin if not in use, or restrict the Overall/Read permission to trusted users only [1][2]. The plugin is listed as having an unresolved security issue in the Jenkins security advisory [2].