Executive Summary

The vulnerability in Jenkins Active Directory Plugin version 2.41 and earlier is that it follows LDAP referrals by default.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability in Jenkins Active Directory Plugin 2.41 and earlier allows the plugin to follow LDAP referrals by default. This behavior can lead to unauthorized access or exposure of sensitive information within the LDAP directory, potentially resulting in confidentiality, integrity, and availability impacts.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the Jenkins Active Directory Plugin following LDAP referrals by default, which can be exploited if an attacker controls the LDAP server or performs a man-in-the-middle attack.

To detect if your system is vulnerable, you should check the version of the Jenkins Active Directory Plugin installed and verify if it is version 2.41 or earlier.

Additionally, monitoring LDAP traffic for unexpected referrals or unusual LDAP server responses could help identify exploitation attempts.

Suggested commands to check the plugin version on the Jenkins server include:

• Using Jenkins CLI or UI to list installed plugins and their versions.
• On the Jenkins server, you can check the plugin directory, for example: `ls $JENKINS_HOME/plugins/active-directory/` and inspect the plugin manifest or version files.

For network detection, you can use tools like tcpdump or Wireshark to capture LDAP traffic and filter for referral messages (LDAP referral responses typically have specific LDAP result codes). Example tcpdump command:

• tcpdump -i <interface> -s 0 -w ldap_traffic.pcap port 389 or port 636
• Then analyze ldap_traffic.pcap in Wireshark for LDAP referral responses.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade the Jenkins Active Directory Plugin to a version later than 2.41 that disables automatic following of LDAP referrals by default.

If upgrading immediately is not possible, consider configuring the plugin or Jenkins to disable following LDAP referrals manually, if such configuration options exist.

Additionally, ensure that your LDAP servers are trusted and protected against man-in-the-middle attacks to reduce the risk of exploitation.

Monitoring and restricting network access to the LDAP service and Jenkins controller can also help mitigate potential attacks.

Useful 0 Not Useful 0