PT-2023-8997 · Jenkins+1 · Jenkins+1
Daniel Beck
·
Published
2023-09-20
·
Updated
2024-04-11
·
CVE-2023-43497
CVSS v2.0
8.5
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
Jenkins versions 2.423 and earlier, LTS 2.414.1 and earlier
Description
The issue is related to the processing of file uploads using the Stapler web framework, which creates temporary files in the default system temporary directory with the default permissions for newly created files. This potentially allows attackers with access to the Jenkins controller file system to read and write the files before they are used. The vulnerability is more significant on operating systems that use a shared temporary directory for all users, typically Linux. However, the default permissions generally only allow attackers to read the temporary file, not write to it.
Recommendations
For Jenkins versions 2.423 and earlier, LTS 2.414.1 and earlier, update to Jenkins 2.424, LTS 2.414.2 or later, which creates temporary files in a subdirectory with more restrictive permissions.
As a temporary workaround for those unable to immediately update Jenkins, consider changing the default temporary-file directory using the Java system property
java.io.tmpdir.Fix
Unrestricted File Upload
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Jenkins
Red Os