CVE-2017-2613 : Security Advisory and Response

Jenkins versions prior to 2.44 and 2.32.2 have a vulnerability where administrators can create a user through CSRF using the GET method. Learn about the impact, technical details, and mitigation steps.

Understanding CVE-2017-2613

Jenkins before versions 2.44 and 2.32.2 is vulnerable to a user creation CSRF using GET by admins. While this user record was only retained until restart in most cases, administrators' web browsers could be manipulated to create a large number of user records (SECURITY-406).

What is CVE-2017-2613?

This CVE refers to a vulnerability in Jenkins versions prior to 2.44 and 2.32.2, allowing administrators to create a user through CSRF using the GET method.

The Impact of CVE-2017-2613

CVSS Score: 5.4 (Medium Severity)
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: Required
Integrity Impact: Low
Availability Impact: Low
The vulnerability could lead to the creation of a significant amount of user records by manipulating administrators' web browsers.

Technical Details of CVE-2017-2613

Vulnerability Description

The vulnerability allows administrators to create a user through CSRF using the GET method in Jenkins versions prior to 2.44 and 2.32.2.

Affected Systems and Versions

Affected Product: Jenkins
Affected Versions:
Jenkins 2.44
Jenkins 2.32.2

Exploitation Mechanism

The vulnerability can be exploited by administrators using the GET method to create a user through CSRF in affected Jenkins versions.

Mitigation and Prevention

Immediate Steps to Take

Upgrade Jenkins to version 2.44 or higher to mitigate the vulnerability.
Monitor user creation activities for any suspicious behavior.

Long-Term Security Practices

Implement regular security training for administrators on CSRF prevention.
Utilize security plugins or tools to enhance Jenkins' security posture.

Patching and Updates

Stay informed about security advisories and promptly apply patches released by Jenkins.