CVE-2023-46657

Root

Cause Jenkins Gogs Plugin versions 1.0.15 and earlier employ a non-constant time comparison function when verifying whether a provided webhook token matches the expected token [1][2]. This means the comparison time varies based on the correctness of the input, leaking information about the secret token.

Exploitation

An attacker can send a series of requests with different token candidates and measure the response time to infer the correct token character by character [1]. No authentication is required to trigger the webhook endpoint, making it externally accessible over the network.

Impact

By obtaining a valid webhook token, an attacker can authenticate to the Jenkins instance as the plugin and trigger builds or other configured actions, potentially leading to unauthorized code execution or information disclosure [1].

Mitigation

As of the advisory publication date (October 25, 2023), no fixed version is available for the Gogs Plugin [3]. Users are advised to limit access to the Jenkins instance or disable the plugin if not essential [1].