CVE-2024-47803: Jenkins Information Disclosure Flaw

CVE-2024-47803 Overview

CVE-2024-47803 affects Jenkins, the open-source automation server widely used for continuous integration and continuous delivery (CI/CD) pipelines. Jenkins 2.478 and earlier, and LTS 2.462.2 and earlier, fail to redact multi-line secret values in error messages generated for form submissions involving the secretTextarea form field. Authenticated users with permission to submit affected forms can trigger errors that expose secrets in plaintext. The flaw is classified as an information disclosure issue [CWE-209] stemming from improper error message handling.

Critical Impact

Authenticated attackers can recover multi-line secrets such as private keys, certificates, and credentials from error messages, undermining secret confidentiality within Jenkins pipelines.

Affected Products

• Jenkins weekly releases 2.478 and earlier
• Jenkins LTS 2.462.2 and earlier
• Jenkins plugins relying on the secretTextarea form field

Discovery Timeline

• 2024-10-02 - Jenkins publishes Security Advisory SECURITY-3451
• 2024-10-02 - CVE-2024-47803 published to NVD
• 2025-03-19 - Last updated in NVD database

Technical Details for CVE-2024-47803

Vulnerability Analysis

The vulnerability resides in Jenkins' form submission error handling logic. Jenkins normally redacts secret values when forms fail validation, replacing them with placeholder content before returning the error response to the user. The redaction logic correctly handles single-line secret fields, but it fails to apply redaction to multi-line values submitted via the secretTextarea form control.

When a form submission containing a secretTextarea value triggers a server-side error, Jenkins echoes the original submitted content back in the rendered error page. This exposes the plaintext secret to any user who can view the error response, including the submitting user and potentially other users with access to logged content.

The secretTextarea control is used by plugins to accept multi-line sensitive material such as Secure Shell (SSH) private keys, Transport Layer Security (TLS) certificates, JSON Web Tokens (JWT), and service account credentials. Exposure of these values can enable lateral movement, unauthorized API access, or pipeline compromise.

Root Cause

The root cause is incomplete output sanitization in error message generation [CWE-209]. The redaction routine that masks secret form field values before rendering errors does not handle the multi-line input type, leaving submitted plaintext intact in the response.

Attack Vector

The attack requires network access to a Jenkins instance and authenticated permissions sufficient to submit forms containing secretTextarea fields. An attacker submits crafted input that intentionally triggers a server-side validation error, then reads the resulting error page to recover the previously submitted multi-line secret. The flaw can also be exploited passively when legitimate users encounter form errors and the resulting content is logged or cached.

No verified public proof-of-concept exploit code is available. See the Jenkins Security Advisory SECURITY-3451 for technical details.

Detection Methods for CVE-2024-47803

Indicators of Compromise

• Jenkins HTTP responses containing secretTextarea field content rendered in error pages or stack traces
• Web server or reverse proxy logs capturing 4xx or 5xx responses from Jenkins form endpoints with unusually large response bodies
• Browser cache, proxy cache, or log aggregator entries containing strings such as -----BEGIN PRIVATE KEY----- or -----BEGIN CERTIFICATE----- originating from Jenkins URLs

Detection Strategies

• Inspect Jenkins access logs for repeated form submission failures from the same authenticated session against endpoints that use secretTextarea
• Audit centralized logging platforms for Jenkins error responses that contain secret-like patterns, including PEM blocks, API tokens, and base64-encoded keys
• Review plugin configurations to identify which Jenkins plugins use the secretTextarea field and prioritize monitoring for those endpoints

Monitoring Recommendations

• Enable verbose audit logging on Jenkins and forward logs to a centralized analytics platform for content inspection
• Configure data loss prevention (DLP) rules in proxy or egress monitoring tools to flag PEM headers and credential patterns leaving Jenkins
• Track Jenkins version inventory across the environment and alert when instances run versions below 2.479 or LTS 2.462.3

How to Mitigate CVE-2024-47803

Immediate Actions Required

• Upgrade Jenkins weekly releases to 2.479 or later, and Jenkins LTS to 2.462.3 or later
• Rotate any secrets that may have been entered into secretTextarea fields on vulnerable Jenkins instances, including SSH keys, TLS certificates, and API tokens
• Review web proxy, browser, and log aggregator caches for exposed secret material and purge affected entries

Patch Information

The Jenkins project addressed CVE-2024-47803 in Jenkins 2.479 and LTS 2.462.3. The fix extends the existing form field redaction logic to cover multi-line secretTextarea values, ensuring submitted content is masked in error responses. Patch details are documented in the Jenkins Security Advisory SECURITY-3451.

Workarounds

• Restrict permissions to limit which users can submit forms containing secretTextarea fields, reducing the population of accounts able to trigger exposure
• Place Jenkins behind a reverse proxy configured to strip or rewrite response bodies for error status codes on form submission endpoints until patching is complete
• Avoid using secretTextarea fields for highly sensitive material on unpatched instances, substituting Jenkins Credentials store references where supported

# Verify Jenkins version on a Linux controller
java -jar /usr/share/jenkins/jenkins.war --version

# Example: Upgrade Jenkins LTS on Debian-based systems
sudo apt-get update
sudo apt-get install --only-upgrade jenkins
sudo systemctl restart jenkins