CVE-2023-37943: Medium severity Jenkins Active Directory Jenkins vulnerability
Jenkins Active Directory Plugin 2.30 and earlier ignores the "Require TLS" and "StartTls" options and always performs the connection test to Active directory unencrypted, allowing attackers able to capture network traffic between the Jenkins controller and Active Directory servers to obtain Active Directory credentials.
Other sources
Jenkins Active Directory Plugin allows testing a new, unsaved configuration by performing a connection test (the button labeled "Test Domain").
Active Directory Plugin 2.30 and earlier ignores the "Require TLS" and "StartTls" options and always performs the connection test to Active directory unencrypted. This allows attackers able to capture network traffic between the Jenkins controller and Active Directory servers to obtain Active Directory credentials.
This only affects the connection test. Connections established during the login process are encrypted if the corresponding TLS option is enabled.
Active Directory Plugin 2.30.1 considers the "Require TLS" and "StartTls" options for connection tests.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.jenkins-ci.plugins:active-directoryto a version that resolves this vulnerability.Fixed in 2.30.1 - Upgrade
Upgrade
Jenkins Active Directory Pluginto a version that resolves this vulnerability.Fixed in 2.30.1 - Configuration
Ensure the Active Directory plugin connection test uses TLS by enabling the corresponding TLS option ("Require TLS") in the plugin configuration. In v2.30.1 and later, connection tests honor "Require TLS" and "StartTls"; in v2.30 and earlier they are ignored and tested unencrypted.
Jenkins Active Directory Plugin Require TLS = enabled - Configuration
Ensure the Active Directory plugin connection test uses TLS by enabling "StartTls" in the plugin configuration. In v2.30.1 and later, connection tests honor "StartTls"; in v2.30 and earlier they are ignored for the connection test.
Jenkins Active Directory Plugin StartTls = enabled - Compensating control
Since the issue only affects the connection test, limit exposure of any unencrypted traffic created by the "Test Domain" button (e.g., restrict network/ACL access between the Jenkins controller and Active Directory servers so attackers cannot capture traffic and obtain credentials during connection testing).
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-37943.
What is the severity of CVE-2023-37943?
The severity of CVE-2023-37943 is medium.
What is the affected software?
The affected software is Jenkins Active Directory Plugin version 2.30 and earlier.
What is the fix for CVE-2023-37943?
To fix CVE-2023-37943, upgrade Jenkins Active Directory Plugin to version 2.30.1 or later.
Where can I find more information about CVE-2023-37943?
You can find more information about CVE-2023-37943 in the advisory from Jenkins, the OSS Security mailing list, and the NIST National Vulnerability Database.