CVE-2024-47807: Jenkins OpenID Auth Bypass Vulnerability

CVE-2024-47807 Overview

CVE-2024-47807 is an authentication bypass vulnerability in the Jenkins OpenId Connect Authentication Plugin. Versions 4.354.v321ce67a_1de8 and earlier do not validate the iss (Issuer) claim of an ID Token. Attackers can subvert the OpenID Connect (OIDC) authentication flow and potentially obtain administrator access to the Jenkins controller. The flaw is tracked as [CWE-287: Improper Authentication] and is documented in the Jenkins Security Advisory 2024-10-02.

Critical Impact
Successful exploitation can grant attackers administrator-level access to Jenkins, exposing build pipelines, secrets, and downstream production systems.

Affected Products

Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier
Jenkins controllers configured to use OIDC for single sign-on
Any CI/CD environment relying on this plugin for identity federation

Discovery Timeline

2024-10-02 - Jenkins publishes Security Advisory SECURITY-3441 covering the issue
2024-10-02 - CVE-2024-47807 published to NVD
2025-05-06 - Last updated in NVD database

Technical Details for CVE-2024-47807

Vulnerability Analysis

The Jenkins OpenId Connect Authentication Plugin federates user identities by validating ID Tokens issued by an OpenID Provider. The plugin accepts an ID Token, verifies its signature, and maps claims such as sub and email to a Jenkins user. The vulnerable versions omit verification of the iss claim, which identifies the token issuer.

Without an issuer check, the plugin trusts any ID Token whose signature can be verified against a configured key, regardless of which provider produced it. An attacker who controls or uses a different OpenID Provider can mint a token containing claims that collide with a privileged Jenkins user. The plugin then authenticates the attacker as that user.

Root Cause

The root cause is missing validation of the iss claim required by RFC 7519 and the OpenID Connect Core specification. Section 3.1.3.7 of OIDC Core mandates that clients verify the iss value matches the Issuer Identifier of the trusted OpenID Provider. The plugin skipped this step, breaking the trust boundary between distinct identity providers.

Attack Vector

Exploitation occurs over the network and requires no prior authentication, though attack complexity is high because the attacker must control or abuse a token issuer whose signing key the plugin accepts. The attacker crafts an ID Token containing the sub or email of a Jenkins administrator, signs it with a key the plugin will validate, and submits it through the OIDC callback. The plugin authenticates the attacker as the targeted administrator and grants full Jenkins privileges.

No verified public proof-of-concept code is available. See the Jenkins Security Advisory 2024-10-02 for additional technical details.

Detection Methods for CVE-2024-47807

Indicators of Compromise

Successful Jenkins logins for administrative users from unfamiliar IP addresses or geographic regions.
OIDC authentication events where the issuer URL in audit data does not match the configured OpenID Provider.
New or modified Jenkins jobs, credentials, or build agents created shortly after an unexpected administrator login.
Unexpected use of the Jenkins script console or installation of plugins by federated identities.

Detection Strategies

Parse Jenkins authentication logs and correlate session identifiers with the originating OIDC issuer when available.
Alert on any privileged Jenkins user whose authentication chain references an unrecognized issuer endpoint.
Inventory Jenkins instances and report any controller running OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 or earlier.

Monitoring Recommendations

Forward Jenkins $JENKINS_HOME/logs and the audit trail to a centralized SIEM for retention and correlation.
Monitor outbound traffic from Jenkins controllers to OIDC discovery and JWKS endpoints, and alert on connections to unexpected hosts.
Track changes to global security configuration and plugin updates as high-priority events.

How to Mitigate CVE-2024-47807

Immediate Actions Required

Upgrade the Jenkins OpenId Connect Authentication Plugin to a fixed release published in the Jenkins Security Advisory 2024-10-02.
Audit Jenkins administrator accounts and revoke sessions established before the upgrade.
Rotate Jenkins credentials, API tokens, and secrets that may have been exposed to a federated session.
Review recent job configurations, build history, and plugin installations for unauthorized changes.

Patch Information

Jenkins released a fixed version of the OpenId Connect Authentication Plugin alongside Security Advisory SECURITY-3441 on 2024-10-02. The patched plugin validates the iss claim against the configured OpenID Provider Issuer Identifier and rejects tokens whose issuer does not match. Administrators should install the update through the Jenkins Plugin Manager and restart the controller.

Workarounds

If immediate patching is not possible, disable the OpenId Connect Authentication Plugin and revert to an alternative authentication realm such as LDAP or matrix-based local accounts.
Restrict network access to Jenkins login and OIDC callback endpoints to trusted IP ranges using a reverse proxy or firewall.
Require multi-factor authentication at the OpenID Provider for all accounts that map to Jenkins administrators.

bash

# Verify the installed plugin version on a Jenkins controller
curl -s -u "$JENKINS_USER:$JENKINS_TOKEN" \
  "$JENKINS_URL/pluginManager/api/json?depth=1" \
  | jq '.plugins[] | select(.shortName=="oic-auth") | {shortName, version, enabled}'