CVE-2023-32986

What it actually does

The flaw is an authenticated arbitrary file write caused by insufficient validation of Stashed File Parameter names in Jenkins File Parameter Plugin 285.v757c5b_67a_c25 and earlier. A user with Item/Configure permission can define or modify a job parameter so that the uploaded file name resolves outside the intended storage location, allowing attacker-controlled content to create or overwrite files on the Jenkins controller filesystem. Because the write occurs on the controller, impact can include configuration tampering, credential or user file modification, persistence through startup scripts or plugins, denial of service by corrupting critical files, and potential code execution if a writable target is interpreted or executed by Jenkins or the host. The provided package metadata lists pimcore/pimcore with fixed commit 58012d0e3b8b926fb54eccbd64ec5c993b30c22c, but the vulnerability description identifies the Jenkins File Parameter Plugin; asset owners should validate the affected component during remediation.

Why it matters to the business

Successful exploitation can let a lower-privileged Jenkins user turn job configuration access into control over files on the build controller, which may compromise CI/CD integrity, expose secrets, alter build outputs, disrupt release pipelines, or provide a foothold for broader compromise. The CVSS score is high and the EPSS score is elevated, indicating meaningful likelihood of exploitation even though it is not currently listed in CISA KEV and no ransomware use is reported. Because CI/CD systems often hold deployment credentials and build trusted software artifacts, compromise can create downstream operational and supply-chain risk.

How an attack unfolds

An attacker first obtains an account or token that has Item/Configure permission for a Jenkins job. They configure a Stashed File Parameter with a crafted name that includes path traversal or an absolute/controlled path component rather than a simple file name. When the job is run and the parameter file is uploaded, the plugin uses the attacker-controlled name to derive the destination file path without adequately constraining it to the intended stash area. The controller writes the uploaded content to the attacker-selected location. The attacker then chooses targets that produce the desired outcome, such as overwriting a job configuration, placing a Groovy initialization script for later execution, modifying user or credential-related files, adding a malicious plugin, corrupting files to cause outage, or planting files that are executed by downstream build or administrative processes.

How to fix it

Upgrade the Jenkins File Parameter Plugin to a version newer than 285.v757c5b_67a_c25 that enforces safe file names for Stashed File Parameters. If using the package metadata supplied with this record, verify whether pimcore/pimcore is actually in scope and update to a revision containing commit 58012d0e3b8b926fb54eccbd64ec5c993b30c22c; however, prioritize validation against the Jenkins plugin advisory because the vulnerability description is Jenkins-specific. As temporary mitigation, remove or disable the File Parameter Plugin where not required, replace Stashed File Parameters with safer mechanisms, restrict Item/Configure permission to trusted administrators only, review all jobs using file parameters, and run the Jenkins controller with least-privileged OS permissions and filesystem protections that prevent writes to sensitive locations where possible. Back up and integrity-check Jenkins home before and after patching.

How to confirm the fix worked

Confirm the installed Jenkins File Parameter Plugin version is later than 285.v757c5b_67a_c25 or otherwise contains the vendor fix. Inventory jobs for Stashed File Parameter usage and verify parameter names are simple names without path separators, traversal sequences, drive letters, shell metacharacters, or absolute paths. Review role assignments to ensure only trusted administrators have Item/Configure permission. On disk, compare critical Jenkins controller files against known-good backups or configuration-as-code sources, especially job config.xml files, init.groovy.d scripts, plugin files, user configs, credentials-related files, and recently modified files under JENKINS_HOME. If validating a Pimcore Git dependency due to local package metadata, confirm the deployed revision includes 58012d0e3b8b926fb54eccbd64ec5c993b30c22c.

Typical attack path

1. Gain authenticated access to Jenkins with Item/Configure permission on at least one job.
2. Create or modify a job to use a Stashed File Parameter.
3. Set the parameter name or resulting uploaded file name to a path that escapes the intended storage directory.
4. Trigger or wait for a build that accepts the malicious file parameter upload.
5. Upload attacker-controlled file content through the build parameter.
6. Cause Jenkins controller to create or overwrite the selected filesystem path.
7. Leverage the written file for persistence, configuration tampering, secret exposure, denial of service, or code execution depending on the target path.

How to detect it

Review Jenkins security/audit logs, access logs, job configuration history, build records, and controller filesystem timestamps for signs of prior exploitation. Focus on job configuration changes by users with Item/Configure permission, especially additions or edits to Stashed File Parameters shortly before builds with file uploads. Search job config.xml and historical config snapshots for Stashed File Parameter definitions whose names contain ../, ..\, leading slashes, Windows drive letters, URL-encoded traversal, or paths to sensitive Jenkins or OS locations. Examine builds that accepted file parameters and correlate them with file creation or modification events outside the expected job/build workspace or stash directories. Inspect JENKINS_HOME for unexpected changes to init.groovy.d, plugins, users, credentials, secrets, job config.xml files, nodes, and global configuration. If endpoint telemetry or file integrity monitoring is available, hunt for the Jenkins process writing to unusual locations such as startup script directories, plugin directories, SSH authorized_keys files, cron/systemd locations, web roots, or credential/configuration files. Investigate any suspicious Groovy scripts, newly added plugins, modified user configuration, or unexplained controller restarts after parameterized builds.

• hudson.plugins.file_parameters.StashedFileParameterDefinition
• StashedFileParameterDefinition
• ../
• ..\\
• %2e%2e%2f
• %2e%2e%5c
• /var/lib/jenkins/init.groovy.d/
• /var/jenkins_home/init.groovy.d/
• $JENKINS_HOME/init.groovy.d/
• C:\\ProgramData\\Jenkins\\.jenkins\\init.groovy.d\\
• /var/lib/jenkins/plugins/
• /var/jenkins_home/plugins/
• $JENKINS_HOME/plugins/
• /var/lib/jenkins/users/
• /var/jenkins_home/users/
• $JENKINS_HOME/users/
• /var/lib/jenkins/credentials.xml
• /var/jenkins_home/credentials.xml
• $JENKINS_HOME/credentials.xml
• /var/lib/jenkins/secrets/
• /var/jenkins_home/secrets/
• $JENKINS_HOME/secrets/
• /.ssh/authorized_keys
• /etc/cron.d/
• /etc/systemd/system/

What your security team should do

• Treat exposed Jenkins controllers and any controller with broad Item/Configure delegation as high priority for upgrade or plugin removal.
• Immediately inventory Jenkins File Parameter Plugin installations and upgrade affected versions beyond 285.v757c5b_67a_c25.
• Audit all Jenkins jobs that use Stashed File Parameters for suspicious parameter names containing path traversal, absolute paths, Windows drive paths, or unexpected file extensions.
• Review Item/Configure permissions and remove them from non-administrative users, service accounts, and broadly assigned groups where not strictly required.
• Search Jenkins audit logs, access logs, job config history, and filesystem modification times for evidence of suspicious job reconfiguration and file uploads.
• Check integrity of JENKINS_HOME against backups or configuration-as-code baselines, focusing on startup scripts, plugins, credentials, users, and job definitions.
• Rotate Jenkins secrets, API tokens, deployment credentials, and downstream CI/CD credentials if arbitrary file writes or suspicious controller changes are found.
• Add SIEM detections for Jenkins job configuration changes involving Stashed File Parameters with path traversal or absolute path patterns.