CVE-2022-28158: Missing permission Phoenix AutoTest Plugin
Summary
CVE-2022-28158: Missing permission Jenkins Pipeline Phoenix AutoTest Plugin. Affects com.surenpi.jenkins:phoenix-autotest versions < 1.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Phoenix AutoTest Plugin is a Maven package (com.surenpi.jenkins:phoenix-autotest) used in Jenkins for automating tests. It provides functionality for running tests and managing credentials. The plugin allows users to execute tests and store credentials securely. However, a vulnerability has been identified in versions 1.3 and earlier, which allows attackers with Overall/Read permission to enumerate credentials IDs stored in Jenkins.
Vulnerability Detail
The vulnerability (CVE-2022-28158) in the Phoenix AutoTest Plugin arises from a missing permission check. Attackers with Overall/Read permission can exploit this vulnerability to enumerate credentials IDs. This can lead to unauthorized access to sensitive information stored in Jenkins. The vulnerability has a CVSS score of 6.5, indicating a moderate severity level. The Common Weakness Enumeration (CWE) ID associated with this vulnerability is CWE-862.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can restrict the Overall/Read permission to trusted individuals or groups. By limiting access to this permission, the risk of unauthorized enumeration of credentials IDs can be mitigated. Here is an example of how to restrict the Overall/Read permission using the Jenkins Script Console:
import jenkins.model.Jenkins
def jenkinsInstance = Jenkins.getInstance()
def authorizationStrategy = jenkinsInstance.getAuthorizationStrategy()
authorizationStrategy.setOverallReadPermission('authenticated')
jenkinsInstance.save()
This script sets the Overall/Read permission to 'authenticated' users only, ensuring that only authenticated users can enumerate credentials IDs.
Conclusion
The missing permission vulnerability in the Phoenix AutoTest Plugin can allow unauthorized enumeration of credentials IDs in Jenkins. To mitigate this vulnerability, it is recommended to update the plugin to version 1.4 or later. Alternatively, restricting the Overall/Read permission can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.surenpi.jenkins:phoenix-autotest →
FAQ
The vulnerability allows attackers with Overall/Read permission to enumerate credentials IDs stored in Jenkins. This can lead to unauthorized access to sensitive information, potentially compromising the security of the system.
Users of Jenkins with the Phoenix AutoTest Plugin versions 1.3 and earlier are affected by this vulnerability. Specifically, attackers with Overall/Read permission can exploit the vulnerability.
There are no known instances of this vulnerability being exploited in the wild. However, it is important to apply the recommended fix or workaround to mitigate the risk of exploitation.
Yes, a patch is available for this vulnerability. Users should update the Phoenix AutoTest Plugin to version 1.4 or later to apply the fix.
Yes, you can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file.
Related vulnerabilities
Recent vulnerabilities recorded for com.surenpi.jenkins:phoenix-autotest.
