CVE-2026-84649: Jenkins Stapler: CSRF crumb exposed in dynamically generated JavaScript endpoint SECURITY-3607

Jenkins 2.579 bundles Stapler 2107.v8dfcb_e8ed317, whose dynamically generated JavaScript proxy endpoint serializes the authenticated user's CSRF crumb as a JavaScript string literal. A page controlled by an attacker on a sibling host in the same site can load that endpoint as a script, define makeStaplerProxy, capture the literal, and submit a cross-origin HTML form carrying the stolen crumb. In the current production-path proof, real Chromium logged in a victim, visited attacker.example.test, loaded the script from jenkins.example.test, recovered the crumb, and created a Jenkins API token through a POST that returned HTTP 403 without the crumb and HTTP 200 with the stolen crumb. Jenkins 2.580 replaces the literal with a DOM expression and is not vulnerable through this endpoint.

• Affected component: Jenkins core's Stapler integration and Stapler's dynamic JavaScript proxy endpoint /$stapler/bound/script/....
• Affected versions: Stapler 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317 inclusive, except 2088.2093.vd7c3e58008a_6; Jenkins weekly 2.447 through 2.579 inclusive; Jenkins LTS 2.452.1 through 2.568.2 inclusive.
• Risk and consequences: High according to Jenkins SECURITY-3878 (the ticket metadata said medium). The prerequisite is attacker-controlled active content on the same site as Jenkins, such as a sibling subdomain; the Resource Root URL being configured on that same site makes this particularly impactful. A victim must visit the attacker content while logged in. The attacker page can then authorize state-changing actions within the victim's Jenkins permissions. This run demonstrated creation of a new API token in the victim account.

Impact Parity

• Disclosed/claimed maximum impact: CSRF crumb theft leading to full authenticated-session action forgery (authz_bypass).
• Reproduced impact from this run: A real sibling-host attacker page exfiltrated the victim's crumb in Chromium and used an ordinary cross-origin HTML form to create a victim API token. An identical state-changing POST without the stolen crumb returned HTTP 403; the forged POST returned HTTP 200 and produced token UUID e81361f4-1998-41ca-98e0-dd36d6a7b747 in the final run.
• Parity: full.
• Not demonstrated: No stronger impact than actions already authorized to the victim was claimed or tested. The issued secret token value is intentionally not copied into this report.

Root Cause

Jenkins initializes Stapler's org.kohsuke.stapler.CrumbIssuer adapter in core/src/main/java/hudson/security/csrf/CrumbIssuer.java. In the vulnerable release, the adapter implements issueCrumb by returning Jenkins.get().getCrumbIssuer().getCrumb(request). Stapler's Bound.getProxyScript consumes that value when rendering its dynamic proxy resource and single-quotes it in output such as:

varname = makeStaplerProxy('/whatever','SESSION_CRUMB',['methodname']);

Script inclusion is not protected by the browser same-origin read restriction in the way fetch is: a sibling-host page can load this JavaScript and provide its own makeStaplerProxy function to receive the literal argument. Because the sibling hosts are same-site, a victim's Jenkins session cookie is also eligible for the subsequent form POST. The endpoint therefore reveals the second anti-CSRF factor to the party that can already induce the browser to send the first factor.

Fix commit 95e24c6cfa75efd4a7c079ef091df6fd02748d1a ([SECURITY-3878]) changes the adapter to override getCrumbExpression() and return document.head.dataset.crumbValue when CSRF protection is enabled. Stapler 2117.vb_66952503166 then emits:

varname = makeStaplerProxy('/whatever',document.head.dataset.crumbValue,['methodname']);

The secret is no longer present in the cross-host script response. Jenkins 2.580 contains the fix; 2.579 does not. The tested peeled release commits were 9095ea3a5c5e7dcd392695a5dd880af1c9910ddf and 497de4961ad80d97e26bfdeb0d2e40442a84ecb0 respectively.

Reproduction Steps

1. Run bundle/repro/reproduction_steps.sh from any directory. The script reads PRUVA_ROOT or resolves the bundle path itself.
2. The script pulls and verifies these exact images:
   • vulnerable Jenkins 2.579 JDK 21: sha256:a7342867ea33efaacf825229d50b7fc77c144ecada9719ab4e32419f5d7412be;
   • fixed Jenkins 2.580 JDK 21: sha256:0e50a5b11ac14f3b84e529d725ed3a1c4b17ba16188dfa8d9a0189428b0839b1;
   • Playwright v1.55.0 Noble: sha256:b27e719ecbfef153e13fd24e8341736733bf2658b229677eb21ff57ff5d7fb29.
3. It starts real Jenkins controllers, creates and form-authenticates a victim, executes bundle/repro/same_site_attack.js in real Chromium, and serves an in-browser attacker page at attacker.example.test which loads the Jenkins script endpoint at sibling jenkins.example.test.
4. It submits the state-changing token-generation action with an actual cross-origin HTML form using the captured crumb. It also runs two isolated direct vulnerable attempts and two Jenkins 2.580 fixed negative-control attempts.
5. Expected success output is CONFIRMED: Jenkins 2.579 exposed a session crumb ...; Jenkins 2.580 did not. The script exits nonzero unless the no-crumb request is 403, the vulnerable stolen-crumb request is 200, and both fixed attempts omit the literal and emit the safe DOM expression.

Evidence

• Real browser exploit result: bundle/repro/proof/browser-same-site-result.json
  • attacker_origin=http://attacker.example.test:8081/attack.html
  • victim_authenticated_as=victim
  • no_crumb_http=403
  • stolen_crumb_http=200
  • created_token_uuid=e81361f4-1998-41ca-98e0-dd36d6a7b747
• Browser-created state-change marker: bundle/repro/proof/browser-same-site-marker.txt.
• Browser/Jenkins service transcript: bundle/repro/proof/browser-same-site.service.log.
• Two direct vulnerable attempt summaries: bundle/repro/proof/vulnerable_1.result.txt and vulnerable_2.result.txt. Each records authentication, no-crumb HTTP 403, equality between the dynamic-script literal and the authenticated session crumb, and stolen-crumb HTTP 200.
• State-changing responses: bundle/repro/proof/vulnerable_1.stolen_crumb.response.body and vulnerable_2.stolen_crumb.response.body contain Jenkins status: ok and fresh token UUIDs.
• Fixed negative controls: bundle/repro/proof/fixed_1.dynamic-js.response.body and fixed_2.dynamic-js.response.body contain document.head.dataset.crumbValue, while both fixed result files record an empty dynamic literal and no attempted forged action.
• Loaded product/component identity: bundle/repro/proof/*product-component-identity.txt binds the exact WAR SHA-256 and bundled Stapler jars (2107 vulnerable, 2117 fixed).
• Image identities: bundle/repro/proof/target-identities.txt.
• Hash binding: bundle/repro/runtime_manifest.json lists 48 finalized proof artifacts and the SHA-256 of each. It identifies the executed vulnerable image and peeled Jenkins commit.
• Root-cause source evidence: bundle/logs/repro/security-3878-source-diff.txt, vulnerable-source-snippet.txt, fixed-source-snippet.txt, and fix-commit-identity.txt.
• Repeated execution: bundle/logs/reproduction_steps-redacted1.stdout and reproduction_steps-redacted2.stdout both contain the confirmation line; both corresponding stderr logs are empty.

No sanitizer was used. This was a production HTTP and browser workflow against the official Jenkins images, not a parser/unit harness.

Recommendations / Next Steps

• Upgrade Jenkins weekly to 2.580 or later, or LTS to 2.568.3 or later.
• If immediate upgrade is impossible, disable the Resource Root URL feature or place it on a different registrable domain rather than a sibling host on the Jenkins site.
• Do not host untrusted active content on the Jenkins site.
• Preserve regression tests that request /$stapler/bound/script/whatever?var=...&methods=... with CSRF enabled and assert that the response contains no crumb-like literal and does contain the DOM expression.
• Test with a real browser and sibling-host setup so script inclusion and SameSite cookie behavior remain covered.

Additional Notes

• The exact final script and helper passed twice consecutively after digest pinning and the cross-origin form enhancement. Their SHA-256 values are 487358e21524f0215abf5a00acf9898d07f00b04c995a7fb377285f0bc6f3914 and 88bf6d58888e4ec722c4739c968d8347c730f97ce8d40d21ba0169c1de2f0605.
• Every controller uses a fresh temporary Docker volume and every invocation removes its containers, network, and labeled volumes.
• The ticket summary calls this SECURITY-3607; the Jenkins advisory, source test, and fix commit consistently identify it as SECURITY-3878.
• The browser helper installs the exact playwright@1.55.0 Node package into a temporary volume while reusing the matching immutable Playwright image's Chromium. Network access is therefore required for first-time image and package acquisition.