CVE-2022-25207: CSRF vulnerability in Jenkins Chef Sinatra Plugin allow XXE
Summary
CVE-2022-25207: CSRF vulnerability in Jenkins Chef Sinatra Plugin allow XXE. Affects org.jenkins-ci.plugins:sinatra-chef-builder versions < 1.20. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Jenkins Chef Sinatra Plugin is a Maven package (org.jenkins-ci.plugins:sinatra-chef-builder) that integrates with Jenkins to provide functionality related to Chef and Sinatra. It allows users to configure and manage Chef and Sinatra deployments within Jenkins. The plugin version 1.20 and earlier are affected by a CSRF vulnerability that enables XML External Entity (XXE) attacks.
Vulnerability Detail
The CSRF vulnerability in the Jenkins Chef Sinatra Plugin arises from a lack of permission checks in a form validation method. Attackers with Overall/Read permission can exploit this vulnerability to make Jenkins send an HTTP request to a URL controlled by the attacker. The response from the URL is parsed as XML by Jenkins. Since the plugin does not configure its XML parser to prevent XXE attacks, attackers can craft XML responses that extract secrets from the Jenkins controller or perform server-side request forgery. This vulnerability is rated as HIGH severity with a CVSS score of 7.1.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If upgrading the plugin is not immediately feasible, a temporary workaround is to restrict Overall/Read permission for users who do not require it. This reduces the attack surface for potential CSRF attacks.
Conclusion
The CSRF vulnerability in the Jenkins Chef Sinatra Plugin allows for XXE attacks and potential unauthorized access to secrets. It is crucial to upgrade to version 1.21 or later to mitigate this vulnerability. If immediate upgrade is not possible, restricting Overall/Read permission can reduce the risk. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:sinatra-chef-builder →
FAQ
The vulnerability allows attackers to perform CSRF attacks and exploit XXE vulnerabilities. This can lead to unauthorized access to secrets stored in the Jenkins controller or server-side request forgery.
At the time of this advisory, there is no known public exploit for this vulnerability.
No, only versions 1.20 and earlier are affected. Version 1.21 and later include the necessary fixes.
Yes, the CVSS score for this vulnerability is 7.1, indicating a high severity.
You can find more information about this vulnerability in the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-x92v-xv3x-9v29/GHSA-x92v-xv3x-9v29.json
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:sinatra-chef-builder.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
