CVE-2023-32986 Jenkins File Parameter Plugin arbitrary file write vulnerability
Attackers with Item/Configure permission can create or replace arbitrary files on the Jenkins controller via unrestricted file names in Stashed File Parameters.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-32986?
CVE-2023-32986 is a high-severity path traversal vulnerability in Jenkins File Parameter Plugin, published on 16 May 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Jenkins File Parameter Plugin 285.v757c5b_67a_c25 and earlier does not restrict the name (and resulting uploaded file name) of Stashed File Parameters, allowing attackers with Item/Configure permission to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content.
Weakness: CWE-732
Which versions are affected by CVE-2023-32986?
2 open source packages ship an affected version, including io.jenkins.plugins:file-parameters. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
io.jenkins.plugins:file-parameters Maven | All versions | 285.287.v4b |
io.jenkins.plugins:file-parameters Maven | All versions | 285.287.v4b |
Products include Jenkins File Parameters.
How do I fix CVE-2023-32986?
Upgrade io.jenkins.plugins:file-parameters to 285.287.v4b or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-32986 being exploited?
There is no known exploitation of CVE-2023-32986 in the wild and no public exploit code.
Sources
Also known as GHSA-46f2-x6h2-x9hx.