CVE-2023-43500

Vulnerability

A cross-site request forgery (CSRF) vulnerability exists in the Jenkins Build Failure Analyzer Plugin versions 2.4.1 and earlier. The plugin does not require a multi-step or confirmation process for actions that initiate connections to external servers, allowing an attacker to craft a malicious request that, when executed by an authenticated user, triggers the plugin to connect to an attacker-specified hostname and port [1][2].

Exploitation

To exploit this vulnerability, an attacker must trick a Jenkins user with sufficient permissions into clicking on a crafted link or visiting a malicious webpage while that user is authenticated to Jenkins. The attack does not require any special privileges beyond the ability to lure a user. The plugin will then attempt to connect to the attacker-defined destination using a username and password also supplied by the attacker [1][3].

Impact

If successful, the attacker can cause the Jenkins server to initiate outbound connections to arbitrary hosts on arbitrary ports, potentially facilitating port scanning, exploitation of internal services, or credential brute-force attacks against systems that accept the attacker-supplied credentials [2]. This could lead to further compromise of the Jenkins environment or adjacent infrastructure.

Mitigation

The vulnerability is fixed in Build Failure Analyzer Plugin version 2.4.2, which includes CSRF protection for this operation [2][3]. Users are strongly advised to update to the latest version. No workaround is mentioned in the advisory.