CVE-2022-25183: Protection Mechanism Failure in Jenkins Pipeline: Shared Groovy Libraries Plugin
Summary
CVE-2022-25183: Jenkins Pipeline: Deprecated Groovy Libraries Plugin Protection Mechanism Failure. Affects org.jenkins-ci.plugins.workflow:workflow-cps-global-lib versions < 561.va_ce0de3c2d69. Fixed in 561.va_ce0de3c2d69. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Pipeline: Shared Groovy Libraries Plugin is a component of Jenkins, an open-source automation server. This plugin allows users to define and share reusable Groovy libraries across multiple Jenkins pipelines. It provides a convenient way to centralize and manage common code logic. However, versions 552.vd9cc05b8a2e1 and earlier of the plugin suffer from a protection mechanism failure that can be exploited by attackers with Item/Configure permission.
Vulnerability Detail
The vulnerability arises from the plugin's improper handling of Pipeline library names when creating cache directories. The plugin fails to sanitize the names, allowing attackers to execute arbitrary code in the context of the Jenkins controller JVM. To exploit this vulnerability, an attacker needs to have Item/Configure permission and craft specially designed library names. If a global Pipeline library configured to use caching already exists, the attacker can execute arbitrary code on the Jenkins controller.
How To Fix
Minimum fixed version
561.va_ce0de3c2d69
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading the plugin is not immediately feasible, a temporary workaround is to disable the use of caching for global Pipeline libraries. This can be done by modifying the Jenkins configuration to remove the caching configuration for the affected libraries. However, this workaround may impact performance, as caching is a useful feature for improving pipeline execution speed.
Conclusion
The Jenkins Pipeline: Shared Groovy Libraries Plugin versions 552.vd9cc05b8a2e1 and earlier are vulnerable to a protection mechanism failure that allows attackers to execute arbitrary code on the Jenkins controller. To mitigate this risk, it is recommended to upgrade to version 561.va_ce0de3c2d69 or later. Alternatively, disabling caching for global Pipeline libraries can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins.workflow:workflow-cps-global-lib →
FAQ
This vulnerability allows attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller. The impact can be severe, as it grants unauthorized access and control over the Jenkins environment.
Users of Jenkins Pipeline: Shared Groovy Libraries Plugin versions 552.vd9cc05b8a2e1 and earlier are affected by this vulnerability. Specifically, those who have configured global Pipeline libraries to use caching.
At the time of this advisory, there are no known public exploits targeting this vulnerability. However, it is crucial to apply the recommended fix or workaround to mitigate the risk of potential exploitation.
No, this vulnerability requires an attacker to have Item/Configure permission in the Jenkins environment. Remote exploitation is not possible unless the attacker already has the necessary access privileges.
Yes, the CVSS score for this vulnerability is 8.8, indicating a high severity level. It is crucial to address this vulnerability promptly to prevent potential unauthorized code execution.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins.workflow:workflow-cps-global-lib.
