Jenkins REST API Object Serialization Injection

Executive Summary

Jenkins versions 2.579 and earlier, including LTS 2.568.2 and earlier, have a flaw where map keys are not properly escaped during JSON and Python serialization in the REST API. This allows attackers who control map property names to inject arbitrary fields into API responses.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking Jenkins instances for versions 2.579 or earlier and LTS 2.568.2 or earlier. Inspect REST API responses for unexpected field injections in JSON or Python formats. Verify if map keys in API responses are properly escaped.

Useful 0 Not Useful 0

Impact Analysis

Attackers could manipulate API responses to include malicious data, potentially leading to misinformation, unauthorized access, or further exploitation of systems relying on Jenkins API responses.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by exposing sensitive data through JSON and Python API responses. Attackers may inject arbitrary fields into these responses, potentially leaking confidential information. This could violate data protection requirements under GDPR (e.g., Article 32 on security of processing) and HIPAA (e.g., safeguards for protected health information).

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Jenkins to version 2.580 or later, or LTS 2.568.3 or later, as these versions address the JSON and Python API response injection issue.

Useful 0 Not Useful 0