CVE-2025-27625: Jenkins Open Redirect Vulnerability

CVE-2025-27625 Overview

CVE-2025-27625 is an Open Redirect vulnerability (CWE-601) affecting Jenkins automation server versions 2.499 and earlier, as well as LTS versions 2.492.1 and earlier. The vulnerability exists in how Jenkins handles URL redirects that begin with backslash (\) characters. Jenkins incorrectly considers these redirects as safe, but web browsers interpret backslash characters as part of scheme-relative redirects, allowing attackers to redirect users to malicious external websites.

Critical Impact

Attackers can leverage this vulnerability to conduct phishing attacks by crafting malicious Jenkins URLs that redirect authenticated users to attacker-controlled websites, potentially leading to credential theft or malware distribution.

Affected Products

• Jenkins weekly releases version 2.499 and earlier
• Jenkins LTS (Long-Term Support) version 2.492.1 and earlier

Discovery Timeline

• 2025-03-05 - CVE-2025-27625 published to NVD
• 2025-06-24 - Last updated in NVD database

Technical Details for CVE-2025-27625

Vulnerability Analysis

This Open Redirect vulnerability stems from insufficient validation of redirect URLs within Jenkins' web application layer. When processing redirect requests, Jenkins validates whether the target URL is considered "safe" before performing the redirect. However, the validation logic fails to properly handle URLs that begin with backslash characters.

Modern web browsers interpret URLs starting with \\ as scheme-relative redirects, treating them similarly to URLs starting with //. This browser behavior means that a URL like \\malicious-site.com gets interpreted as //malicious-site.com, effectively redirecting the user to an external domain. Jenkins' security validation does not account for this browser quirk, creating a disconnect between what Jenkins considers safe and how browsers actually process these URLs.

The vulnerability is particularly dangerous in the context of a CI/CD automation platform like Jenkins, where users frequently interact with the interface and may trust URLs that appear to originate from their Jenkins instance.

Root Cause

The root cause is improper input validation in Jenkins' URL redirect handling logic. The application's security controls check for common redirect attack patterns (such as URLs starting with // or http://) but fail to recognize that backslash characters are treated equivalently by browsers. This validation gap allows specially crafted URLs with leading backslash characters to bypass the intended security restrictions.

Attack Vector

An attacker can exploit this vulnerability by constructing a malicious URL that points to a legitimate Jenkins instance but includes a redirect parameter with a backslash-prefixed external URL. When a victim clicks on the crafted link, they are initially directed to the trusted Jenkins server, which then redirects them to the attacker-controlled website.

The attack requires user interaction—specifically, the victim must click on the malicious link. This makes the vulnerability well-suited for phishing campaigns, where attackers can send convincing emails or messages containing links that appear to point to a legitimate Jenkins server. Since the initial domain in the URL is the trusted Jenkins instance, users may not recognize the threat until after the redirect occurs.

Detection Methods for CVE-2025-27625

Indicators of Compromise

• Review web server access logs for requests containing backslash characters (\) in URL redirect parameters
• Monitor for unusual redirect patterns where Jenkins URLs redirect to external domains
• Check for user reports of unexpected redirects when accessing Jenkins resources
• Analyze email or communication logs for phishing attempts containing Jenkins URLs with suspicious parameters

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests with backslash characters in redirect-related parameters
• Configure intrusion detection systems to alert on URL patterns matching \\ followed by domain names
• Deploy browser-based security extensions that warn users about cross-domain redirects
• Monitor authentication logs for credential submissions following unusual redirect chains

Monitoring Recommendations

• Enable detailed access logging on Jenkins reverse proxies to capture full request URLs including query parameters
• Set up alerting for any 3xx redirect responses that target external domains
• Regularly audit Jenkins security configurations and installed plugins for additional redirect handling
• Implement user awareness training to help staff recognize phishing attempts leveraging trusted internal URLs

How to Mitigate CVE-2025-27625

Immediate Actions Required

• Upgrade Jenkins weekly releases to version 2.500 or later
• Upgrade Jenkins LTS to version 2.492.2 or later
• Review recent access logs for potential exploitation attempts
• Notify users about the phishing risk and advise caution with Jenkins-related links
• Consider implementing additional URL validation at the reverse proxy level

Patch Information

Jenkins has released security updates addressing this vulnerability. Refer to the Jenkins Security Advisory SECURITY-3501 for detailed patch information and upgrade instructions. Organizations should prioritize upgrading to the fixed versions: Jenkins weekly version 2.500+ or Jenkins LTS version 2.492.2+.

Workarounds

• Deploy a reverse proxy or WAF in front of Jenkins configured to block requests containing backslash characters in redirect parameters
• Implement Content Security Policy (CSP) headers to restrict allowed redirect destinations
• Educate users to verify the final destination URL in their browser address bar after clicking any Jenkins links
• Consider restricting external network access from Jenkins to limit the impact of successful phishing attacks

# Example nginx configuration to block suspicious redirects
# Add to server block protecting Jenkins
location / {
    # Block requests with backslash in common redirect parameters
    if ($args ~* "redirect=\\\\|url=\\\\|next=\\\\|return=\\\\") {
        return 403;
    }
    proxy_pass http://jenkins_backend;
}