CVE-2025-27624 Overview
CVE-2025-27624 is a cross-site request forgery (CSRF) vulnerability affecting Jenkins 2.499 and earlier, and LTS 2.492.1 and earlier. The flaw allows attackers to trick authenticated users into toggling the collapsed or expanded state of sidepanel widgets, such as the Build Queue and Build Executor Status widgets. Exploitation requires user interaction, typically by luring an authenticated Jenkins user to a malicious page. The vulnerability is tracked under CWE-352 and was disclosed in the Jenkins Security Advisory #SECURITY-3498.
Critical Impact
Attackers can force authenticated Jenkins users to modify the UI state of sidepanel widgets via forged requests, resulting in low-impact integrity and availability effects on the user interface.
Affected Products
- Jenkins 2.499 and earlier
- Jenkins LTS 2.492.1 and earlier
- Jenkins core (jenkins:jenkins)
Discovery Timeline
- 2025-03-05 - Jenkins publishes Security Advisory #SECURITY-3498
- 2025-03-05 - CVE-2025-27624 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-27624
Vulnerability Analysis
The vulnerability stems from missing CSRF protection on the endpoint responsible for persisting user preferences for sidepanel widget state. Jenkins exposes widgets such as the Build Queue and Build Executor Status in a collapsible sidepanel. The action that stores whether these widgets are expanded or collapsed does not validate an anti-CSRF token (crumb) on incoming requests.
An attacker who convinces an authenticated Jenkins user to visit an attacker-controlled page can issue a forged request that changes the target user's widget state. The Exploit Prediction Scoring System (EPSS) rates this issue at 0.41%, placing it in the 32.9 percentile of vulnerabilities by likelihood of exploitation. There are no known public exploits and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.
Root Cause
The root cause is missing enforcement of CSRF protection (CWE-352) on the request handler that toggles sidepanel widget visibility. Jenkins normally requires a crumb token on state-changing HTTP requests, but this specific handler accepted requests without validating that token, allowing cross-origin submissions to succeed against an authenticated session.
Attack Vector
Exploitation occurs over the network and requires user interaction. The attacker crafts a webpage or email containing an HTML form or scripted request targeting the vulnerable Jenkins endpoint. When an authenticated Jenkins user loads the malicious content, the browser attaches the user's session cookies to the forged request, and Jenkins toggles the sidepanel widget state on behalf of that user. No credentials are transmitted to the attacker, and only the user interface state of the victim is altered.
No verified proof-of-concept code has been published. Refer to the Jenkins Security Advisory #SECURITY-3498 for authoritative technical detail.
Detection Methods for CVE-2025-27624
Indicators of Compromise
- Unexpected changes to the collapsed or expanded state of Build Queue or Build Executor Status widgets reported by authenticated Jenkins users.
- HTTP POST requests to Jenkins widget-state endpoints originating from Referer or Origin headers outside the Jenkins deployment domain.
- Access log entries showing state-toggle requests without an accompanying valid CSRF crumb parameter.
Detection Strategies
- Enable and review Jenkins access logs for requests targeting sidepanel widget preference endpoints and correlate them against expected user activity.
- Deploy a web application firewall rule that flags or blocks state-changing POST requests to Jenkins with mismatched Origin or Referer headers.
- Compare user session activity against widget-state change events to identify actions inconsistent with active user sessions.
Monitoring Recommendations
- Forward Jenkins HTTP access logs and audit events to a centralized log platform for cross-referencing with authentication events.
- Alert on Jenkins requests where the Origin header does not match the Jenkins controller hostname.
- Track upgrade status of Jenkins controllers to ensure fixed versions are deployed across all environments.
How to Mitigate CVE-2025-27624
Immediate Actions Required
- Upgrade Jenkins weekly releases to a version later than 2.499 and Jenkins LTS to a version later than 2.492.1 as identified in the Jenkins Security Advisory.
- Verify that the Jenkins CSRF protection setting is enabled on all controllers.
- Inform Jenkins users to avoid clicking untrusted links while authenticated to the Jenkins web UI.
Patch Information
Jenkins addressed CVE-2025-27624 in Jenkins 2.500 and Jenkins LTS 2.492.2 by enforcing CSRF protection on the sidepanel widget state handler. Full remediation details are published in the Jenkins Security Advisory #SECURITY-3498.
Workarounds
- Restrict Jenkins controller access to trusted networks using firewall or reverse proxy rules to limit CSRF exposure from arbitrary internet sources.
- Require Jenkins users to use dedicated browser profiles or sessions that are not used for general web browsing.
- Configure reverse proxy rules that reject requests to Jenkins containing external Referer or Origin headers until the patch is applied.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
