CVE-2023-41943

Vulnerability

Overview Jenkins AWS CodeCommit Trigger Plugin versions 3.0.12 and earlier contain a missing permission check in an HTTP endpoint. The endpoint does not verify that the user has the required authorization before allowing the action to clear the Amazon SQS queue used for CodeCommit triggers [1][3]. This is a classic authorization bypass vulnerability.

Exploitation

An attacker with only Overall/Read permission (the lowest Jenkins permission) can exploit this flaw by sending a crafted HTTP request to the vulnerable endpoint [2]. No additional privileges or special network access is required beyond being able to reach the Jenkins instance. The attacker does not need to be authenticated as an administrator.

Impact

Successful exploitation allows the attacker to clear the SQS queue, which disrupts the processing of AWS CodeCommit triggers. This can lead to a denial of service condition where legitimate trigger events are lost, potentially causing missed builds or deployments [1]. The impact is limited to the SQS queue; no data exfiltration or code execution is reported.

Mitigation

As of the September 2023 security advisory, no fix has been released for this plugin [2]. Administrators are advised to restrict access to Jenkins instances, ensure only trusted users have Overall/Read permission, or disable the plugin if it is not essential. The vulnerability is not known to be exploited in the wild.