CVE-2024-47805: Jenkins Credentials Info Disclosure Flaw

CVE-2024-47805 Overview

CVE-2024-47805 affects the Jenkins Credentials Plugin version 1380.va_435002fa_924 and earlier, except 1371.1373.v4eb_fa_b_7161e9. The plugin fails to redact encrypted values of credentials using the SecretBytes type when item config.xml is accessed through the REST API or CLI. Authenticated users with read access to affected items can retrieve encrypted credential values that should have been masked. This is an information disclosure issue tracked under [CWE-522: Insufficiently Protected Credentials].

Critical Impact
Attackers with item read permission can extract encrypted SecretBytes credential values from config.xml via REST API or CLI, exposing sensitive credential material.

Affected Products

Jenkins Credentials Plugin 1380.va_435002fa_924 and earlier
Jenkins Credentials Plugin versions excluding 1371.1373.v4eb_fa_b_7161e9
Jenkins controllers using the Credentials Plugin with SecretBytes-typed credentials

Discovery Timeline

2024-10-02 - Jenkins publishes Security Advisory SECURITY-3373
2024-10-02 - CVE-2024-47805 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-47805

Vulnerability Analysis

The Jenkins Credentials Plugin manages sensitive secrets used by jobs, agents, and integrations. Credentials of the SecretBytes type store binary secret material such as certificates, keystores, or arbitrary file-based secrets. Jenkins normally redacts these values when serializing item configuration to config.xml, so unprivileged readers cannot harvest credential blobs.

In affected versions, this redaction does not occur for SecretBytes values when config.xml is retrieved through the REST API endpoint or the Jenkins CLI. The encrypted blob is returned in the response payload. The exposure is network-reachable and requires no user interaction. The vulnerability is classified as information disclosure with confidentiality impact only.

While the leaked values are encrypted with the Jenkins controller secret, an attacker who later obtains the master key, or who already has any level of access enabling secret recovery, can decrypt the captured material. This expands the blast radius of any subsequent Jenkins controller compromise.

Root Cause

The plugin's serialization logic for item configuration omits the redaction path for SecretBytes credential fields. Other credential types are correctly masked. The defect aligns with [CWE-522], where credential storage protections do not consistently apply across all access paths.

Attack Vector

An attacker authenticated to Jenkins with Item/Extended Read or equivalent permission on an affected item issues a GET request to the item's config.xml endpoint or runs the CLI get-job command. The response contains the encrypted SecretBytes values inline. Public-facing Jenkins instances permitting anonymous or low-privilege read access broaden the attack surface.

See the Jenkins Security Advisory SECURITY-3373 for additional technical context.

Detection Methods for CVE-2024-47805

Indicators of Compromise

HTTP GET requests to /job/<name>/config.xml or nested folder equivalents from unexpected user accounts or service principals
Jenkins CLI invocations of get-job against jobs known to hold SecretBytes credentials
Audit log entries showing Item/ExtendedRead access bursts across many jobs in a short window
Outbound transfer of large XML payloads from the Jenkins controller to external destinations

Detection Strategies

Inspect Jenkins access logs for repeated config.xml retrievals correlated with users lacking administrative roles
Alert on CLI sessions invoking get-job, list-credentials, or bulk job export operations
Compare the installed Credentials Plugin version against the fixed releases listed in the Jenkins advisory

Monitoring Recommendations

Forward Jenkins access and audit logs to a centralized log platform and apply correlation rules for credential-related endpoints
Track plugin inventory drift to identify controllers still running vulnerable Credentials Plugin builds
Monitor network egress from Jenkins controllers for anomalous response sizes on config.xml paths

How to Mitigate CVE-2024-47805

Immediate Actions Required

Upgrade the Jenkins Credentials Plugin to a release later than 1380.va_435002fa_924, or to the fixed line 1371.1373.v4eb_fa_b_7161e9 if pinned to LTS
Audit which Jenkins items use SecretBytes credentials and rotate any secrets that may have been exposed
Review Item/ExtendedRead and equivalent grants and remove unnecessary read permissions

Patch Information

Jenkins addressed the issue in the Credentials Plugin builds documented in Jenkins Security Advisory SECURITY-3373. Update through the Jenkins Plugin Manager and restart the controller. Verify the installed version after restart.

Workarounds

Restrict Item/ExtendedRead, Item/Configure, and REST/CLI access to trusted administrators until the plugin is upgraded
Disable anonymous read access on Jenkins controllers exposed beyond trusted networks
Migrate SecretBytes-typed credentials to credential stores external to Jenkins where feasible

bash

# Verify the installed Credentials Plugin version via Jenkins CLI
java -jar jenkins-cli.jar -s https://jenkins.example.com/ \
  -auth admin:$API_TOKEN \
  list-plugins | grep -i credentials

# Upgrade through the Plugin Manager UI:
# Manage Jenkins > Plugins > Updates > select "Credentials" > Download and install after restart