PT-2025-28904 · Jenkins · Jenkins Git Parameter Plugin+1

Roman Nahornyi · Published 2025-07-09 · Updated 2025-10-01 · CVE-2025-53652

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:N/C:C/I:P/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Git Parameter Plugin versions 439.vb 0e46ca 14534 and earlier

Description The Jenkins Git Parameter Plugin does not validate the Git parameter value submitted to a build against the offered choices. This allows attackers with Item/Build permissions to inject arbitrary values into Git parameters, potentially leading to command execution. Reports indicate approximately 15,000 Jenkins servers are potentially at risk, with some exposed without authentication. The vulnerability allows for remote code execution (RCE) and could lead to full system compromise, data leakage, and supply chain attacks. The BRANCH PARAM variable is an example of a parameter susceptible to injection. Attackers can leverage Git to execute commands. The API endpoint /job/buildName/build is involved in the exploitation process, utilizing parameters like Jenkins-Crumb and BRANCH PARAM.

Recommendations Update the Jenkins Git Parameter Plugin to version 444.vca b 84d3703c2 or later. Verify that the bypass flag -Dnet.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition.allowAnyParameterValue=true is not enabled. Perform an audit of the Jenkins configuration to disable unnecessary plugins.

Exploit

Fix

RCE

Weakness Enumeration

CWE-1287

CWE-20

Related Identifiers

BDU:2025-08311

CVE-2025-53652

GHSA-QCJ2-99CG-MPPF

Affected Products

Jenkins

Jenkins Git Parameter Plugin

References · 39

• 🔥 https://github.com/pl4tyz/CVE-2025-53652-Jenkins-Git-Parameter-Analysis · Exploit
• https://osv.dev/vulnerability/CVE-2025-53652 · Vendor Advisory
• https://jenkins.io/security/advisory/2025-07-09/#SECURITY-3419 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-08311 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-53652 · Security Note
• https://osv.dev/vulnerability/GHSA-qcj2-99cg-mppf · Vendor Advisory
• https://github.com/jenkinsci/git-parameter-plugin · Note
• https://twitter.com/freedomhack101/status/1954176499440828733 · Twitter Post
• https://twitter.com/Cloudflare/status/1955080596968935741 · Twitter Post
• https://t.me/cvenotify/129489 · Telegram Post
• https://jenkins.io/security/advisory/2025-07-09 · Note
• https://twitter.com/HackRead/status/1953902799970086946 · Twitter Post
• https://twitter.com/davidi99/status/1954898606512541714 · Twitter Post
• https://twitter.com/MrsYisWhy/status/1953903222868869391 · Twitter Post
• https://twitter.com/HunterMapping/status/1955449803661533272 · Twitter Post