CVE-2023-43494: Jenkins Information Disclosure Flaw

CVE-2023-43494 Overview

A sensitive information exposure vulnerability exists in Jenkins that allows attackers with Item/Read permission to extract sensitive build variables through the build history widget search functionality. Jenkins versions 2.50 through 2.423 and LTS versions 2.60.1 through 2.414.1 fail to exclude sensitive build variables such as password parameter values from search operations. This enables attackers to iteratively test different characters through the search interface until they discover the correct sequence, effectively brute-forcing sensitive credential values.

Critical Impact

Attackers with basic read access can extract password parameters and other sensitive build variables used in CI/CD pipelines, potentially compromising deployment credentials, API keys, and other secrets.

Affected Products

• Jenkins 2.50 through 2.423 (weekly releases)
• Jenkins LTS 2.60.1 through 2.414.1 (Long-Term Support releases)

Discovery Timeline

• September 20, 2023 - CVE-2023-43494 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2023-43494

Vulnerability Analysis

This vulnerability represents an information disclosure flaw in Jenkins' build history widget search functionality. The core issue stems from the search feature's failure to properly filter out sensitive build parameters when indexing and returning search results. When users perform builds with parameterized jobs containing sensitive values (such as passwords, API tokens, or secrets), these values should be masked and excluded from searchable content.

The vulnerability allows an attacker with legitimate but limited Jenkins access (Item/Read permission) to abuse the search functionality as an oracle. By systematically testing different character sequences and observing which searches return results, an attacker can incrementally reconstruct sensitive variable values character by character. This timing-based information extraction technique requires only basic authenticated access to the Jenkins instance.

Root Cause

The root cause is improper handling of sensitive build variables within the search indexing mechanism. Jenkins maintains various types of build parameters, some marked as sensitive (like password parameters). The build history widget search feature failed to respect these sensitivity classifications, inadvertently including sensitive values in the searchable index. This design oversight allowed the search function to leak information about whether specific character sequences exist within sensitive parameter values.

Attack Vector

The attack leverages the network-accessible Jenkins web interface and requires low-privileged authenticated access. An attacker with Item/Read permission on a job can:

1. Access the build history widget for a target job
2. Use the search functionality to test if specific characters or strings appear in build data
3. Observe search results to determine if the tested sequence matches sensitive variable content
4. Iterate through possible characters to reconstruct complete sensitive values

This character-by-character enumeration technique is similar to blind SQL injection attacks, where information is extracted based on observable differences in application behavior. The attack requires no user interaction and can be automated to rapidly extract credential values.

Detection Methods for CVE-2023-43494

Indicators of Compromise

• Unusual patterns of search queries in Jenkins access logs, particularly sequential single-character or short string searches
• High volume of build history widget search requests from a single user or IP address
• Search queries that appear to follow a systematic pattern indicative of brute-force enumeration
• Access log entries showing repeated searches against jobs containing sensitive parameters

Detection Strategies

• Monitor Jenkins access logs for anomalous search activity patterns, especially rapid sequential searches
• Implement rate limiting on search functionality to slow enumeration attempts
• Audit user permissions to identify accounts with unnecessary Item/Read access to sensitive jobs
• Review Jenkins audit logs for suspicious activity around builds containing credential parameters

Monitoring Recommendations

• Enable comprehensive Jenkins audit logging to capture all search operations
• Configure alerting for unusual search query volumes or patterns
• Regularly review which users have Item/Read permission on jobs with sensitive parameters
• Implement SIEM integration to correlate Jenkins activity with other security events

How to Mitigate CVE-2023-43494

Immediate Actions Required

• Upgrade Jenkins weekly releases to version 2.424 or later
• Upgrade Jenkins LTS to version 2.414.2 or later
• Review and restrict Item/Read permissions to only users who require access
• Audit jobs for sensitive parameter usage and consider alternative credential management approaches

Patch Information

Jenkins has addressed this vulnerability in their Security Advisory #SECURITY-3261. The fix ensures that sensitive build variables are properly excluded from the build history widget search functionality. Organizations should upgrade to Jenkins weekly 2.424 or LTS 2.414.2 to receive the security patch. Additional technical discussion is available on the Openwall OSS-Security mailing list.

Workarounds

• Implement strict access controls to limit Item/Read permissions to trusted users only
• Consider using Jenkins Credentials Plugin for secret management instead of password parameters
• Disable or restrict access to the build history widget where feasible
• Implement network-level controls to limit Jenkins access to trusted networks

# Example: Review users with Item/Read permission via Jenkins CLI
java -jar jenkins-cli.jar -s http://jenkins-server/ who-am-i
# Audit job permissions and restrict as needed through Jenkins security configuration