CVE-2025-64139: Jenkins Start Windocks Containers Plugin is missing a permission check

The vulnerability lies in an unsecured HTTP endpoint within the Jenkins Start Windocks Containers Plugin. The analysis of the plugin's source code, specifically the WinDocksBuilder.java file, revealed that the doFillImageItems method in the nested DescriptorImpl class is exposed without any permission checks. This method is intended to populate a UI dropdown with Docker image names from a given Windocks server IP.

The doFillImageItems method takes an ipaddress as a query parameter and passes it to the GetImages method. The GetImages method then constructs a URL with the provided ipaddress and makes an HTTP GET request to fetch image data. Because there is no validation on the ipaddress parameter, an attacker with only Overall/Read permissions can craft a request to this endpoint, forcing the Jenkins server to make a request to any URL or IP address on their behalf. This constitutes a Server-Side Request Forgery (SSRF) vulnerability. The advisory also correctly points out that the endpoint is vulnerable to Cross-Site Request Forgery (CSRF) because it responds to GET requests, which can be triggered from a malicious website visited by a logged-in Jenkins user.