CVE-2023-50770

Vulnerability

Overview

The Jenkins OpenId Connect Authentication Plugin versions 2.6 and earlier stores the password of a local user account used as an anti-lockout feature in a recoverable format. This means the password is not properly encrypted or hashed, making it susceptible to recovery by an attacker with access to the Jenkins controller file system [1][4].

Exploitation

An attacker must have access to the Jenkins controller's file system to exploit this vulnerability. This could be achieved through a separate compromise or by a malicious insider. Once access is obtained, the attacker can recover the plain text password of the local user account [1][4].

Impact

Recovering this password likely allows the attacker to gain administrator access to Jenkins, as the anti-lockout account typically has high privileges. This could lead to full control over the Jenkins environment and potentially compromise connected systems [1][4].

Mitigation

As of the advisory date (2023-12-13), this vulnerability remains unresolved in the OpenId Connect Authentication Plugin. No fix or workaround has been provided by the Jenkins security team [1][3]. Users are advised to restrict file system access and monitor for suspicious activity.