A critical vulnerability in Jenkins enables attackers to bypass origin validation through DNS rebinding, potentially leading to full system compromise.

The vulnerability exists in the CLI WebSocket endpoint, which uses untrusted HTTP Host or X-Forwarded-Host headers to validate origins. This allows an unauthenticated, remote attacker to perform DNS rebinding attacks and bypass origin validation.

The ability to bypass origin validation can allow an attacker to interact with the Jenkins instance as if they were an authorized user, leading to unauthorized configuration changes, job execution, or sensitive data exfiltration. Given the CVSS score of 7.5, this high severity flaw poses a significant risk to CI/CD pipeline integrity, potentially allowing attackers to inject malicious code into software build processes.

Immediate Action: Upgrade to Jenkins version 2.555 or later, or the appropriate fixed LTS release, as specified in the Jenkins security advisory.

Proactive Monitoring: Monitor server access logs for anomalous traffic patterns directed at the CLI WebSocket endpoint or requests containing unexpected Host headers.

Compensating Controls: Implement strict network access controls or a Web Application Firewall (WAF) to block requests containing suspicious or malformed Host headers until patches can be applied.

Public Exploit Available: Unknown

Jenkins administrators must prioritize this update due to the potential for unauthorized access to the automation server. Applying the vendor-provided patches is the only reliable method to eliminate the risk of DNS rebinding attacks on the affected CLI WebSocket interface.