CVE-2024-47807

Vulnerability

The Jenkins OpenId Connect Authentication Plugin, versions 4.354.v321ce67a_1de8 and earlier, does not verify the iss (Issuer) claim in the ID Token received during the OpenID Connect authentication flow [1]. This omission means the plugin accepts tokens from any issuer, not just the trusted identity provider.

Exploitation

An attacker can craft or obtain a valid ID Token from a different, potentially malicious, OpenID provider and present it during login. Because the plugin ignores the iss claim, it cannot distinguish between a token intended for the Jenkins instance and a token issued by an attacker-controlled provider [2]. The attack does not require prior authentication; it targets the initial login process.

Impact

Successful exploitation allows the attacker to subvert the authentication flow and potentially gain administrator access to Jenkins [1]. Once authenticated with a forged token, the attacker may have full control over the Jenkins instance, including the ability to execute build jobs, manage credentials, and access sensitive data.

Mitigation

Jenkins has released version 4.355.v6a_8a_c559c8b_2 of the OpenId Connect Authentication Plugin, which adds proper validation of the iss claim [2]. All users are strongly advised to update immediately. No workaround is available for older versions.