CVE-2025-27623: Jenkins Information Disclosure Flaw

CVE-2025-27623 Overview

CVE-2025-27623 is a sensitive data exposure vulnerability affecting Jenkins 2.499 and earlier, as well as LTS 2.492.1 and earlier. The vulnerability exists because Jenkins does not properly redact encrypted values of secrets when accessing config.xml of views via the REST API or CLI. This allows attackers with View/Read permission to view encrypted values of secrets, potentially compromising sensitive configuration data.

Critical Impact
Attackers with View/Read permission can access encrypted secret values through the Jenkins REST API or CLI, potentially exposing sensitive credentials and configuration data.

Affected Products

Jenkins 2.499 and earlier
Jenkins LTS 2.492.1 and earlier

Discovery Timeline

2025-03-05 - CVE-2025-27623 published to NVD
2025-06-24 - Last updated in NVD database

Technical Details for CVE-2025-27623

Vulnerability Analysis

This vulnerability is classified under CWE-312 (Cleartext Storage of Sensitive Information). When authenticated users with View/Read permission access the config.xml file of views through Jenkins' REST API or CLI interfaces, the system fails to properly redact encrypted secret values. While the secrets remain encrypted, exposing these encrypted values provides attackers with cryptographic material that could potentially be decrypted offline or used in further attacks against the Jenkins infrastructure.

The exposure occurs specifically through the configuration export functionality, where Jenkins serializes view configurations to XML format. Under normal circumstances, sensitive values should be masked or completely omitted from API responses to prevent information leakage, even to users with read access.

Root Cause

The root cause lies in improper handling of sensitive data serialization within Jenkins' view configuration export mechanism. When generating XML output for the config.xml endpoint, the application fails to apply the same redaction logic that would normally protect encrypted secret values. This oversight allows the raw encrypted values to be included in API and CLI responses, violating the principle of least privilege.

Attack Vector

The attack vector is network-based and requires low privileges. An attacker must have authenticated access to Jenkins with at least View/Read permission. Once authenticated, the attacker can leverage the REST API or CLI to request the config.xml of views, which will return configuration data including encrypted secret values that should have been redacted.

The exploitation process involves making authenticated requests to Jenkins endpoints that serve view configurations. While this requires valid credentials with minimal permissions, the exposure of encrypted secrets represents a significant information disclosure that could facilitate further attacks.

Detection Methods for CVE-2025-27623

Indicators of Compromise

Unusual or excessive API requests to config.xml endpoints for views
Repeated REST API calls from users who typically don't access configuration data
CLI access patterns targeting view configurations from unexpected sources
Bulk export attempts of view configurations through the Jenkins API

Detection Strategies

Monitor Jenkins access logs for requests to /view/*/config.xml endpoints
Implement alerting for API access to configuration endpoints from low-privilege accounts
Audit authentication logs for accounts accessing sensitive configuration data
Review Jenkins audit logs for CLI commands that retrieve view configurations

Monitoring Recommendations

Enable and centralize Jenkins audit logging for all API and CLI operations
Configure SIEM rules to detect anomalous access patterns to configuration endpoints
Implement rate limiting on configuration export endpoints to prevent bulk extraction
Set up alerts for View/Read users accessing config.xml through non-standard interfaces

How to Mitigate CVE-2025-27623

Immediate Actions Required

Upgrade Jenkins to version 2.500 or later immediately
For LTS users, upgrade to Jenkins LTS 2.492.2 or later
Review and restrict View/Read permissions to only essential users
Audit existing view configurations for sensitive data exposure
Rotate any secrets that may have been exposed through this vulnerability

Patch Information

Jenkins has released security patches addressing this vulnerability. Users should upgrade to Jenkins 2.500 or later for the weekly release, or Jenkins LTS 2.492.2 or later for the Long-Term Support release. Detailed information is available in the Jenkins Security Advisory #SECURITY-3496.

Workarounds

Restrict View/Read permissions to only trusted users until patches can be applied
Disable REST API access for non-administrative users if feasible
Use network-level controls to limit API access to trusted networks
Monitor and audit all access to configuration endpoints while awaiting patch deployment
Consider temporarily disabling CLI access if not operationally required

bash

# Review users with View/Read permissions in Jenkins
# Navigate to: Manage Jenkins > Security > Configure Global Security
# Audit the authorization strategy and restrict View/Read to essential users only

# If using Role-Based Access Control, review roles with View/Read permission
# Jenkins CLI command to list users (requires admin access):
java -jar jenkins-cli.jar -s http://your-jenkins-url/ list-users