CVE-2022-25174: Improper Neutralization of Special Elements used in an OS Command in Jenkins Pipeline: Shared Groovy Libraries Plugin
Summary
CVE-2022-25174: Jenkins Pipeline: Shared Groovy Libraries Plugin prior to 561.va_ce0de3c2d69, 2.21.1, and 2.18.1 uses the same checkout directories for distinct SCMs for Pipeline libraries, allowing attackers with Item/Configure permiss... Affects org.jenkins-ci.plugins.workflow:workflow-cps-global-lib across 3 version ranges.
< 2.18.1
>= 2.19, < 2.21.1
>= 544.vff04fa68714d, < 561.va
Fixed in 2.18.1, 2.21.1 or 561.va, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Pipeline: Shared Groovy Libraries Plugin is a component of Jenkins, an open-source automation server. This plugin allows users to define and share reusable Groovy code libraries for their Jenkins pipelines. It provides a convenient way to centralize and manage common code logic across multiple pipelines. However, versions prior to 561.va_ce0de3c2d69, 2.21.1, and 2.18.1 of the plugin are vulnerable to an OS command injection attack.
Vulnerability Detail
The vulnerability arises from the plugin's improper handling of checkout directories for distinct source code management (SCM) systems used in Pipeline libraries. Attackers with Item/Configure permission can exploit this flaw by crafting malicious SCM contents. By doing so, they can execute arbitrary OS commands on the Jenkins controller. This can lead to unauthorized access, data leakage, or even complete compromise of the Jenkins server.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.18.12.18.1 -
>= 2.19, < 2.21.12.21.1 -
>= 544.vff04fa68714d, < 561.va561.va
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can restrict Item/Configure permission to trusted individuals only. By limiting access to this permission, the risk of exploitation can be reduced. However, this workaround may not be feasible in all scenarios and should be considered a temporary measure until the plugin is updated to a fixed version.
Conclusion
The Jenkins Pipeline: Shared Groovy Libraries Plugin prior to versions 561.va_ce0de3c2d69, 2.21.1, and 2.18.1 is vulnerable to an OS command injection attack. This can allow attackers to execute arbitrary commands on the Jenkins controller, potentially leading to unauthorized access or compromise of the server. It is crucial to upgrade to a fixed version of the plugin and apply any available workarounds to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins.workflow:workflow-cps-global-lib →
FAQ
This vulnerability allows attackers with Item/Configure permission to execute arbitrary OS commands on the Jenkins controller. This can lead to unauthorized access, data leakage, or complete compromise of the Jenkins server.
No, only versions prior to 561.va_ce0de3c2d69, 2.21.1, and 2.18.1 are vulnerable. Users should upgrade to one of these fixed versions to mitigate the risk.
Yes, users can restrict Item/Configure permission to trusted individuals as a temporary workaround. However, this may not be feasible in all cases and should be considered a temporary measure until the plugin is updated.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins server is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for open-source vulnerabilities in real-time.
You can find more information about this vulnerability, including its CVE identifier, on the Vulert website (https://vulert.com). Vulert provides comprehensive vulnerability monitoring and alerting services for open-source software.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins.workflow:workflow-cps-global-lib.
