CVE-2022-30947: Path Traversal in Jenkins Git Plugin
Summary
CVE-2022-30947: Path traversal in Jenkins Git Mercurial and Repo Plugins. Affects org.jenkins-ci.plugins:git versions < 4.11.2. Fixed in 4.11.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Git Plugin is a popular plugin used in Jenkins, an open-source automation server. It provides integration with Git, allowing users to clone and checkout Git repositories for their projects. The plugin supports various URL schemes, including local file system paths. In Jenkins, agents are responsible for checking out SCMs, but some Pipeline-related features also check out SCMs from the Jenkins controller. This means that if an attacker can configure pipelines, they can exploit a path traversal vulnerability to access SCM repositories stored on the Jenkins controller's file system. This vulnerability can lead to the unauthorized disclosure of limited information about other projects' SCM contents.
Vulnerability Detail
The vulnerability (CVE-2022-30947) in the Jenkins Git Plugin allows attackers with the ability to configure pipelines to check out SCM repositories stored on the Jenkins controller's file system using local paths as SCM URLs. By exploiting this path traversal vulnerability, attackers can gain access to limited information about other projects' SCM contents. This can potentially expose sensitive code, credentials, or other confidential information. The vulnerability has a CVSS score of 3.7, indicating a low severity level.
How To Fix
Minimum fixed version
4.11.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading the Jenkins Git Plugin is not immediately feasible, a temporary workaround is to disable the use of local file system paths as SCM URLs. Instead, use remote Git URLs or other supported URL schemes. This can be done by modifying the Jenkins pipeline configuration to specify remote Git URLs or by using a different SCM plugin that does not have this vulnerability.
Conclusion
The path traversal vulnerability in the Jenkins Git Plugin (CVE-2022-30947) allows attackers to access SCM repositories stored on the Jenkins controller's file system using local paths as SCM URLs. This can lead to the unauthorized disclosure of limited information about other projects' SCM contents. To mitigate this vulnerability, it is recommended to upgrade the Jenkins Git Plugin to version 4.11.2 or later. Alternatively, you can disable the use of local file system paths as SCM URLs or switch to a different SCM plugin. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:git →
FAQ
The vulnerability allows attackers to access limited information about other projects' SCM contents. This can potentially expose sensitive code, credentials, or other confidential information.
Users of the Jenkins Git Plugin versions 0 to 4.11.1 are affected by this vulnerability.
There are no known public exploits for this vulnerability at the time of this report.
Yes, the CVSS score for this vulnerability is 3.7, indicating a low severity level.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins instance is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time and alert you if any open-source vulnerabilities, including this one, are found.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:git.
