CVE-2023-41947

Vulnerability

Overview The Jenkins Frugal Testing Plugin (version 1.1 and earlier) contains a missing permission check. This flaw allows attackers who have Overall/Read permission to configure and connect to the Frugal Testing service using attacker-specified credentials, bypassing the intended access controls [1][2].

Exploitation

Conditions An attacker must have at least Overall/Read permission on a Jenkins environment. No other special privileges or prior authentication is required beyond that. The attacker can then supply their own credentials to the plugin, which Jenkins will use without any additional permission verification [3].

Impact

If exploited, an attacker can make Jenkins connect to a Frugal Testing instance under their control, potentially leading to further compromise of the Jenkins environment or data exposure. The plugin's functionality relies on these credentials, so unauthorized usage could result in unintended actions within the CI/CD pipeline [2].

Mitigation

Status As of the advisory publication date (2023-09-06), no fix had been released for the Frugal Testing Plugin. Jenkins recommends users restrict Overall/Read access and consider disabling the plugin if it is not required [1][2].