CVE-2023-27899: Jenkins RCE Vulnerability via File Upload

CVE-2023-27899 Overview

CVE-2023-27899 is a security vulnerability in Jenkins that allows attackers with access to the Jenkins controller file system to potentially achieve arbitrary code execution. The vulnerability stems from insecure temporary file handling during plugin installation, where Jenkins creates temporary files with default permissions in the system's default temporary directory. This race condition vulnerability enables local attackers to read and write the plugin file before Jenkins processes it, potentially allowing malicious code injection.

Critical Impact

Attackers with local file system access to the Jenkins controller can exploit this race condition to inject malicious code during plugin uploads, potentially leading to complete system compromise.

Affected Products

• Jenkins 2.393 and earlier
• Jenkins LTS 2.375.3 and earlier
• All Jenkins installations using default temporary file configurations

Discovery Timeline

• 2023-03-08 - Jenkins Security Advisory published (SECURITY-2823)
• 2023-03-10 - CVE-2023-27899 published to NVD
• 2025-02-28 - Last updated in NVD database

Technical Details for CVE-2023-27899

Vulnerability Analysis

This vulnerability is classified under CWE-863 (Incorrect Authorization), though it manifests as a Time-of-Check Time-of-Use (TOCTOU) race condition in the temporary file handling mechanism. When administrators upload plugins through the Jenkins web interface for installation, the system creates a temporary file to store the plugin archive before processing.

The core issue lies in the file creation process: Jenkins uses the system's default temporary directory (typically /tmp on Linux or %TEMP% on Windows) and relies on default file permissions. On multi-user systems or shared environments, this creates a window of opportunity where an attacker with local access can monitor the temporary directory, identify the newly created plugin file, and modify its contents before Jenkins reads it for installation.

The attack requires precise timing and local file system access to the Jenkins controller, which is why exploitation complexity is considered high despite the severe potential impact.

Root Cause

The root cause is the insecure creation of temporary files during plugin upload operations. Jenkins fails to properly restrict file permissions when creating these temporary files, leaving them accessible to other users on the system. The combination of predictable file location (default temp directory), insufficient access controls (default permissions), and the gap between file creation and file usage creates an exploitable race condition.

Attack Vector

The attack requires local access to the Jenkins controller's file system. An attacker must:

1. Gain access to the same system where the Jenkins controller runs
2. Monitor the temporary directory for newly created plugin files during legitimate upload operations
3. Quickly replace or modify the temporary file content with a malicious plugin archive
4. Wait for Jenkins to process the modified file, installing the attacker's malicious code

The exploitation requires precise timing to win the race condition between file creation and Jenkins reading the file. This is why the attack complexity is rated as high—successful exploitation depends on the attacker being able to modify the file in the narrow window between creation and use.

For detailed technical information, refer to the Jenkins Security Advisory 2023-03-08.

Detection Methods for CVE-2023-27899

Indicators of Compromise

• Unusual file access patterns in the system temporary directory during plugin installations
• Unexpected modifications to plugin files in the temporary storage location
• Suspicious processes monitoring or accessing Jenkins temporary files
• Unauthorized plugins appearing in Jenkins installations

Detection Strategies

• Implement file integrity monitoring on Jenkins temporary directories
• Monitor for rapid file access sequences targeting plugin upload temp files
• Enable audit logging on the Jenkins controller's temporary directory
• Review installed plugins against an approved baseline

Monitoring Recommendations

• Configure endpoint detection to alert on suspicious file operations in temporary directories
• Set up anomaly detection for plugin installation patterns
• Monitor Jenkins controller logs for unexpected plugin installations
• Enable file access auditing on the Jenkins server

How to Mitigate CVE-2023-27899

Immediate Actions Required

• Upgrade Jenkins to version 2.394 or later (weekly releases)
• Upgrade Jenkins LTS to version 2.375.4 or later
• Review recently installed plugins for unauthorized additions
• Restrict local file system access to the Jenkins controller

Patch Information

Jenkins has addressed this vulnerability in version 2.394 (weekly) and version 2.375.4 (LTS). The fix ensures that temporary files created during plugin uploads use restrictive permissions that prevent other users from accessing the files. Organizations should update their Jenkins installations to these versions or later. Refer to the Jenkins Security Advisory for official guidance.

Workarounds

• Configure a dedicated temporary directory for Jenkins with restrictive permissions using the java.io.tmpdir system property
• Ensure the Jenkins controller runs under a dedicated service account with isolated file system access
• Implement strict access controls on the system hosting Jenkins to minimize local user access
• Consider running Jenkins in a containerized environment with isolated file systems

# Configuration example - Set custom temp directory with restrictive permissions
# Add to Jenkins startup configuration or JAVA_OPTS
JAVA_OPTS="-Djava.io.tmpdir=/var/jenkins_home/tmp"

# Ensure the custom temp directory has restrictive permissions
mkdir -p /var/jenkins_home/tmp
chown jenkins:jenkins /var/jenkins_home/tmp
chmod 700 /var/jenkins_home/tmp