CVE-2022-20620: Missing permission checks in SSH Agent Plugin allow enumerating credentials IDs
Summary
CVE-2022-20620: Missing permission checks in SSH Agent Plugin allow enumerating credentials IDs. Affects org.jenkins-ci.plugins:ssh-agent across 2 version ranges.
< 1.22.1
>= 1.23, < 1.23.2
Fixed in 1.22.1 or 1.23.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The SSH Agent Plugin is a plugin for Jenkins, an open-source automation server. It allows users to securely store and use SSH credentials for authentication. The plugin provides functionality to manage SSH keys and use them in Jenkins jobs for secure communication with remote systems. However, prior to versions 1.23.2 and 1.22.1, the plugin had a vulnerability that allowed attackers with Overall/Read access to enumerate credentials IDs stored in Jenkins. This could be exploited as part of an attack to capture the credentials using another vulnerability.
Vulnerability Detail
The vulnerability in the SSH Agent Plugin arises from the lack of permission checks in several HTTP endpoints. This means that attackers with Overall/Read access can enumerate the credentials IDs of stored credentials in Jenkins. By obtaining these credentials IDs, an attacker can potentially use them to gain unauthorized access to systems or perform other malicious actions. It is important to note that the enumeration of credentials IDs in versions 1.23.2 and 1.22.1 of the SSH Agent Plugin requires the appropriate permissions.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.22.11.22.1 -
>= 1.23, < 1.23.21.23.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the latest version of the SSH Agent Plugin.
Conclusion
The SSH Agent Plugin prior to versions 1.23.2 and 1.22.1 has a vulnerability that allows attackers with Overall/Read access to enumerate credentials IDs stored in Jenkins. This can be used as part of an attack to capture the credentials using another vulnerability. To mitigate this vulnerability, it is recommended to upgrade to the latest version of the SSH Agent Plugin. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:ssh-agent →
FAQ
The vulnerability allows attackers with Overall/Read access to enumerate credentials IDs stored in Jenkins. This can be used as part of an attack to capture the credentials using another vulnerability.
Users of Jenkins who have the SSH Agent Plugin installed and have Overall/Read access are affected by this vulnerability.
There are no known exploits for this vulnerability at the moment. However, it is important to patch the vulnerability as soon as possible to prevent any potential attacks.
No, this vulnerability requires attackers to have Overall/Read access to the Jenkins system in order to enumerate credentials IDs.
Yes, the CVSS score for this vulnerability is 4.3 (Moderate).
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:ssh-agent.
