CVE-2022-25179: Link Following in Jenkins Pipeline Multibranch Plugin
Summary
CVE-2022-25179: Link Following in Jenkins Pipeline Multibranch Plugin. Affects org.jenkins-ci.plugins.workflow:workflow-multibranch across 4 version ranges.
< 2.23.1
>= 2.24, < 2.26.1
>= 696.v52535c46f4c9, < 696.698.v9b4218eea50f
>= 706.vd43c65dec013, < 707.v71c3f0a
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Pipeline Multibranch Plugin is a component of the Jenkins automation server that allows users to define and manage pipelines for multibranch projects. It provides a powerful way to define, control, and visualize continuous delivery pipelines. The plugin integrates with various source code management (SCM) systems to automatically create and manage branches and build configurations. However, versions prior to 2.23.1, 2.26.1, 696.698.v9b4218eea50f, and 707.v71c3f0a_6ccdb_ are vulnerable to a link following issue that can be exploited by attackers with Pipeline configuration permissions to read arbitrary files on the Jenkins controller file system.
Vulnerability Detail
The vulnerability in the Jenkins Pipeline Multibranch Plugin allows attackers with the ability to configure Pipelines to follow symbolic links to locations outside of the checkout directory for the configured SCM. This can be exploited by using the readTrusted step to read arbitrary files on the Jenkins controller file system. By leveraging this vulnerability, an attacker can gain unauthorized access to sensitive files and potentially extract confidential information or perform further attacks on the system. The vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.23.12.23.1 -
>= 2.24, < 2.26.12.26.1 -
>= 696.v52535c46f4c9, < 696.698.v9b4218eea50f696.698.v9b4218eea50f -
>= 706.vd43c65dec013, < 707.v71c3f0a707.v71c3f0a
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to the fixed versions of the Jenkins Pipeline Multibranch Plugin.
Conclusion
The Jenkins Pipeline Multibranch Plugin is vulnerable to a link following issue that allows attackers to read arbitrary files on the Jenkins controller file system. To mitigate this vulnerability, users should upgrade to the fixed versions of the plugin. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins.workflow:workflow-multibranch →
FAQ
The Jenkins Pipeline Multibranch Plugin is a component of the Jenkins automation server that allows users to define and manage pipelines for multibranch projects. It provides a powerful way to define, control, and visualize continuous delivery pipelines.
This vulnerability allows attackers with Pipeline configuration permissions to read arbitrary files on the Jenkins controller file system, potentially exposing sensitive information and enabling further attacks.
To fix this vulnerability, it is recommended to upgrade to the fixed versions of the Jenkins Pipeline Multibranch Plugin (2.23.1, 2.26.1, 696.698.v9b4218eea50f, or 707.v71c3f0a).
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to the fixed versions of the Jenkins Pipeline Multibranch Plugin.
The CVSS score of this vulnerability is 6.5, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins.workflow:workflow-multibranch.
