CVE-2022-30954: Missing permission check in Jenkins Blue Ocean Plugin
Summary
CVE-2022-30954: Missing permission check in Jenkins Blue Ocean Plugin. Affects io.jenkins.blueocean:blueocean-parent versions < 1.25.4. Fixed in 1.25.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Blue Ocean Plugin is a plugin for the Jenkins automation server that provides a modern, intuitive user interface for visualizing, editing, and managing Jenkins pipelines. It enhances the user experience by offering a more streamlined and visually appealing interface. The plugin is an integral part of the Jenkins ecosystem and is widely used by developers and DevOps teams.
Vulnerability Detail
The Jenkins Blue Ocean Plugin version 1.25.3 and earlier suffers from a missing permission check vulnerability. This vulnerability allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server. The affected HTTP endpoints do not perform proper permission checks, enabling unauthorized access. An attacker could exploit this vulnerability to establish a connection to a malicious server, potentially leading to further attacks or unauthorized access to sensitive information. The vulnerability has been assigned CVE-2022-30954 and has a CVSS score of 4.3 (Medium severity).
How To Fix
Minimum fixed version
1.25.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by restricting Overall/Read permission to trusted users only. This can be done by modifying the Jenkins configuration to limit access to the affected HTTP endpoints. Here is an example of how to restrict access using the Jenkins Script Console:
import jenkins.model.Jenkins
import hudson.security.Permission
def plugin = Jenkins.instance.pluginManager.getPlugin('blueocean')
def permission = Permission.fromId('hudson.model.Item.Read')
plugin.getExtensionList('io.jenkins.blueocean.rest.impl.pipeline.PipelineImpl').each { endpoint ->
endpoint.setPermission(permission)
}
Jenkins.instance.save()
This workaround will enforce the necessary permission checks until the plugin can be upgraded to a fixed version.
Conclusion
The missing permission check vulnerability in Jenkins Blue Ocean Plugin versions 1.25.3 and earlier can potentially allow unauthorized access to sensitive information. It is crucial to upgrade to version 1.25.4 or later to mitigate this vulnerability. If immediate upgrading is not possible, implementing the provided workaround can help enforce the necessary permission checks. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.jenkins.blueocean:blueocean-parent →
FAQ
This vulnerability allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server. It could potentially lead to unauthorized access to sensitive information or further attacks.
Users of Jenkins Blue Ocean Plugin versions 1.25.3 and earlier are affected by this vulnerability.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is important to promptly apply the recommended fixes to mitigate the risk.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins instance is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this one.
For more information about this vulnerability, you can refer to the GitHub Security Advisory database entry: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-5m4q-x28v-q6wp/GHSA-5m4q-x28v-q6wp.json
Related vulnerabilities
Recent vulnerabilities recorded for io.jenkins.blueocean:blueocean-parent.
