Jenkins Login Redirect Phishing via Tab/Newline Characters

Executive Summary

This vulnerability affects Jenkins versions 2.567 and earlier, including LTS 2.555.2 and earlier. It occurs because Jenkins improperly determines that a redirect URL after login is legitimately pointing to Jenkins when the URL contains tab or newline characters between the double slashes (//).

This flaw allows attackers to craft malicious redirect URLs that appear to be safe but actually lead users to phishing sites.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can be exploited by attackers to perform phishing attacks by redirecting users to malicious sites after login, potentially leading to credential theft or other malicious activities.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify how this vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves improper validation of redirect URLs after login in Jenkins versions 2.567 and earlier, and LTS 2.555.2 and earlier. Detection involves checking if the Jenkins instance accepts redirect URLs containing tab or newline characters between //, which can be exploited for phishing.

To detect this on your system, you can attempt to send crafted login requests with redirect URLs containing tab or newline characters between // and observe if Jenkins redirects to an external domain.

Example command using curl to test the redirect behavior:

• curl -i -X POST -d 'j_username=yourusername&j_password=yourpassword&from=%2F%09%2Fmalicious.com' https://your-jenkins-url/login

Replace %09 with tab character encoding or %0A for newline in the 'from' parameter to test if Jenkins improperly redirects.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade Jenkins to a fixed version where the vulnerability is addressed.

• Upgrade Jenkins to version 2.568 or later, or LTS 2.555.3 or later.

These versions strip tab and newline characters before URL validation and reject URLs containing // anywhere, preventing the open redirect vulnerability.

Useful 0 Not Useful 0