Missing permission checks in AWS Credentials Plugin
Summary
CVE-2022-27199: Missing permission checks in AWS Credentials Plugin. Affects org.jenkins-ci.plugins:aws-credentials versions < 191.vcb_f183ce58b_9. Fixed in 191.vcb_f183ce58b_9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The AWS Credentials Plugin is a Jenkins plugin that allows users to securely store and use AWS credentials in Jenkins. It provides a convenient way to connect to AWS services from Jenkins pipelines and jobs. The plugin integrates with the AWS SDK for Java to authenticate and authorize access to AWS services.
Vulnerability Detail
The AWS Credentials Plugin version 189.v3551d5642995 and earlier has a missing permission check vulnerability. This vulnerability allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token. By exploiting this vulnerability, an attacker can gain unauthorized access to AWS resources and perform actions on behalf of the compromised user.
How To Fix
Minimum fixed version
191.vcb_f183ce58b_9
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the latest version of the AWS Credentials Plugin.
Conclusion
The missing permission checks vulnerability in the AWS Credentials Plugin can lead to unauthorized access to AWS resources. It is crucial to upgrade to the latest version of the plugin to mitigate the risk. Users should also regularly update their Jenkins installation and monitor for any security advisories or patches. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:aws-credentials →
FAQ
This vulnerability allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token. They can gain unauthorized access to AWS resources and perform actions on behalf of the compromised user.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just the pom.xml file.
There are no known exploits for this vulnerability at the moment. However, it is crucial to apply the recommended fix as soon as possible to prevent potential unauthorized access to AWS resources.
No, there is no known workaround for this vulnerability. It is necessary to upgrade to the latest version of the AWS Credentials Plugin to mitigate the risk.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide guidance and assistance in fixing the vulnerability in your Jenkins installation.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:aws-credentials.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
