MediumGHSA-8jfx-h6q2-v4g3 CVE-2014-2066CWE-287Published May 17, 2022

Jenkins session fixation vulnerability

Research is free — Hunters explains how the bug works, the root-cause code pattern, how the fix addresses it, and how to test whether a target is affected, in chat. Investigate & write exploit is a paid run — the engine reads the advisory and fix commits, then builds and validates a working proof-of-concept exploit with reproduction steps.

Affected versions

1.533 → fixed in 1.5510 → fixed in 1.532.2

Details

Session fixation vulnerability in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to hijack web sessions via vectors involving the "override" of Jenkins cookies.

The fix

[FIXED SECURITY-75] Invalidate session after login to avoid

Vojtech Juranek· Jun 13, 2013, 07:45 PM+1−08ac74c3507

core/src/main/java/hudson/security/AuthenticationProcessingFilter2.java+1 −0

@@ -85,6 +85,7 @@ protected void onSuccessfulAuthentication(HttpServletRequest request, HttpServle
         // HttpSessionContextIntegrationFilter stores the updated SecurityContext object into this session later
         // (either when a redirect is issued, via its HttpResponseWrapper, or when the execution returns to its
         // doFilter method.
+        request.getSession().invalidate();
         request.getSession();
     }

Jenkins session fixation vulnerability

Affected versions

Details

The fix

References