CVE-2025-64136: Jenkins Themis Plugin vulnerable to cross-site request forgery

The vulnerability description for CVE-2025-64136 in the Jenkins Themis Plugin states that an HTTP endpoint lacks permission checks and CSRF protection, allowing attackers to make the Jenkins server connect to an arbitrary URL. Since no patch is available, the analysis focused on identifying a method in the plugin's source code that matches this description.

By inspecting the plugin's source code, I identified the doTestConnection method within the com.promyze.themis.jenkins.ThemisGlobalConfiguration$ThemisInstance$ThemisInstanceDescriptor class. In Jenkins, do... methods within Descriptor classes are automatically exposed as HTTP GET endpoints for form validation.

The doTestConnection method takes a url as a query parameter and makes an HTTP GET request to it. The method lacks @RequirePOST annotation or any other CSRF protection, making it vulnerable to CSRF. It also does not perform any permission checks, allowing any user with basic read access to trigger it. This perfectly matches the vulnerability description. An attacker can trick a logged-in Jenkins user into clicking a crafted link, which will cause the Jenkins server to issue a request to a URL of the attacker's choice, leading to a Server-Side Request Forgery (SSRF) vulnerability.