Jenkins LDAP Plugin Unvalidated LDAP Referral Vulnerability Leading to Remote Code Execution

A remote code execution vulnerability exists in the Jenkins LDAP Plugin in versions through 807.v7d7de30930cf. The plugin follows LDAP referrals from the configured LDAP server, which can be manipulated to forward to an RMI URL. This behavior allows for the deserialization of attacker-controlled data, potentially leading to remote code execution on the Jenkins controller, provided that certain deserialization 'gadgets' are available on the classpath. Exploitation requires control over the LDAP server or the ability to perform a man-in-the-middle attack.

Impact

Exploitation of this vulnerability allows for remote code execution on the Jenkins controller.

Remediation

Users of the Jenkins LDAP Plugin should update to version 807.809.vd3a_4e5e4ec98, which no longer follows LDAP referrals. For those unable to update, the vulnerability can be mitigated by setting the Java system property 'hudson.plugins.ldap.referral.ignore' to 'true'.