File Path Parsing Oversight in Jenkins Semantic Versioning Plugin

CVE-2023-24429

What is CVE-2023-24429?

The Jenkins Semantic Versioning Plugin enables unauthorized control over the execution of tasks by failing to restrict the execution of controller/agent messages. This vulnerability arises as a result of insufficient restrictions on the file paths that can be parsed. Attackers controlling agent processes can exploit this weakness, prompting Jenkins to parse specially crafted files, allowing extraction of sensitive secrets from the Jenkins controller. This flaw is critical and poses severe risks related to server-side request forgery, highlighting the necessity for immediate action.

References