Jenkins Arbitrary File Write Vulnerability via Symbolic Links in Archive Extraction

A vulnerability exists in Jenkins versions through 2.554 and LTS through 2.541.2, where symbolic links are not properly managed during the extraction of .tar and .tar.gz files. This flaw allows crafted archives to write files to arbitrary locations on the filesystem, limited only by the file system access permissions of the user running Jenkins. Exploitation could lead to the execution of malicious scripts or the installation of harmful plugins on the Jenkins controller. The vulnerability can be exploited by attackers with Item/Configure permission or those who can control agent processes.

Impact

Successful exploitation allows for arbitrary file writing on the Jenkins controller, which could be used to execute malicious scripts or install harmful plugins.

Remediation

Users should update Jenkins to version 2.555 or LTS 2.541.3. Additionally, Jenkins administrators should remove permissions from the anonymous user.