Jenkins Microsoft Entra ID Open Redirect Vulnerability

A open redirect vulnerability has been identified in the Jenkins Microsoft Entra ID (previously Azure AD) Plugin, specifically in versions through 666.v6060de32f87d. The vulnerability arises because the plugin does not properly restrict the redirect URL after login. This flaw allows attackers to conduct phishing attacks by directing users to a Jenkins URL that, after successful authentication, forwards them to a different site.

Impact

Exploitation of this vulnerability could lead to phishing attacks, where users are tricked into providing credentials or other sensitive information to an attacker-controlled site.

Remediation

Users of the Microsoft Entra ID (previously Azure AD) Plugin should update to version 667.v4c5827a_e74a_0, which addresses the open redirect vulnerability by ensuring that redirects are only to relative Jenkins URLs.