CVE-2022-28155: XML External Entity Reference vulnerability in Jenkins Pipeline: Phoenix AutoTest Plugin
Summary
CVE-2022-28155: XML External Entity Reference vulnerability in Jenkins Pipeline: Phoenix AutoTest Plugin. Affects com.surenpi.jenkins:phoenix-autotest versions < 1.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins Pipeline: Phoenix AutoTest Plugin is a Maven package that provides functionality for automating tests in Jenkins pipelines. It allows users to read and write XML files as part of their build steps. However, versions 1.3 and earlier of the plugin do not properly configure their XML parser to prevent XML external entity (XXE) attacks. This vulnerability can be exploited by attackers who can control the input files for the readXml or writeXml build step. They can craft a malicious XML file that includes external entities, enabling them to extract secrets from the Jenkins controller or perform server-side request forgery.
Vulnerability Detail
The XML External Entity Reference vulnerability in Jenkins Pipeline: Phoenix AutoTest Plugin allows attackers to exploit the XML parser's lack of protection against XXE attacks. By manipulating the input files for the readXml or writeXml build step, an attacker can inject malicious XML code that includes external entities. This can lead to the extraction of sensitive information from the Jenkins controller or enable server-side request forgery, potentially compromising the security and integrity of the Jenkins environment.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the affected build steps (readXml and writeXml) in their Jenkins pipelines. By removing or commenting out these steps, the risk of exploitation can be mitigated. However, this workaround may impact the functionality of the pipeline if these build steps are essential. It is recommended to apply the permanent fix by upgrading the plugin as soon as possible.
Conclusion
The XML External Entity Reference vulnerability in Jenkins Pipeline: Phoenix AutoTest Plugin can be exploited by attackers to extract secrets or perform server-side request forgery. It is crucial to upgrade the plugin to the latest version and ensure that the XML parser is properly configured to prevent XXE attacks. By following the recommended steps, users can enhance the security and integrity of their Jenkins environment. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.surenpi.jenkins:phoenix-autotest →
FAQ
Jenkins Pipeline: Phoenix AutoTest Plugin is a Maven package that provides functionality for automating tests in Jenkins pipelines. It allows users to read and write XML files as part of their build steps.
An XML External Entity (XXE) attack is a type of vulnerability that exploits the XML parser's ability to process external entities. By including malicious external entities in an XML file, an attacker can manipulate the parser to perform actions such as reading local files, initiating network connections, or extracting sensitive information.
This vulnerability can allow attackers to extract secrets from the Jenkins controller or perform server-side request forgery. The extracted secrets can be used to gain unauthorized access to sensitive information or systems, while server-side request forgery can enable attackers to make requests to internal resources on behalf of the Jenkins server, potentially leading to further compromise.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file to analyze the software.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is important to apply the recommended fix as soon as possible to mitigate the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for com.surenpi.jenkins:phoenix-autotest.
