QID 730933

Jenkins is an open-source automation server written in Java. Jenkins helps to automate the non-human part of the software development process, with continuous integration and facilitating technical aspects of continuous delivery.

CVE-2023-43496: Jenkins 2.423 and earlier, LTS 2.414.1 and earlier creates a temporary file in the system temporary directory with the default permissions for newly created files when installing a plugin from a URL, potentially allowing attackers with access to the system temporary directory to replace the file before it is installed in Jenkins.
CVE-2023-43497, CVE-2023-43498: In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using the Stapler web framework or MultipartFormDataParser creates temporary files in the default system temporary directory with the default permissions for newly created files.

Affected Versions:
Jenkins weekly up to and including 2.423
Jenkins LTS up to and including 2.414.1

Fixed Versions:
Jenkins weekly should be updated to version 2.424
Jenkins LTS should be updated to version 2.414.2

NOTE:
This vulnerability only affects operating systems using a shared temporary directory for all users (typically Linux). Additionally, the default permissions for newly created files generally only allow attackers to read the temporary file, but not write to it.

QID Detection Logic(Unauthenticated):
This QID checks for vulnerable version by sending a crafted GET request to Jenkins. This QID also detects the vulnerable version from login page or HTTP header.

Successful exploitation of these vulnerabilities may allow attackers to execute arbitrary code on the target system or allowing attackers with access to the Jenkins controller file system to read and write the files before they are used.