CVE-2025-64140

Vulnerability

The Jenkins Azure CLI Plugin, versions 0.9 and earlier, does not restrict the commands it executes on the Jenkins controller. The plugin is designed to run Azure CLI commands, but it fails to validate or confine the commands that can be submitted, allowing any shell command to be executed through the plugin's interface [1][3].

Exploitation

An attacker needs only the Item/Configure permission on a job to exploit this vulnerability. By crafting a job configuration that includes a malicious command, the attacker can trigger the plugin to run arbitrary shell commands on the Jenkins controller. No additional authentication or network access is required beyond standard Jenkins job configuration capabilities [1][2].

Impact

Successful exploitation grants the attacker the ability to execute arbitrary shell commands on the Jenkins controller with the privileges of the Jenkins process. This can lead to full compromise of the Jenkins server, including data exfiltration, lateral movement, or disruption of operations [1][3].

Mitigation

As of the advisory publication date (2025-10-29), no fix has been released for this vulnerability. Jenkins has announced the issue as unresolved in the plugin. Administrators should restrict Item/Configure permissions to trusted users only and consider disabling the plugin until a patched version becomes available [2].