CVE-2022-30959: Missing Authorization in Jenkins SSH plugin
Summary
CVE-2022-30959: Missing Authorization in Jenkins SSH plugin. Affects org.jenkins-ci.plugins:ssh versions < 2.6.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins SSH Plugin is a Maven package (org.jenkins-ci.plugins:ssh) that provides functionality for connecting to SSH servers from Jenkins. It allows users to execute commands on remote machines via SSH. The plugin is widely used in Jenkins installations for various automation tasks.
Vulnerability Detail
The Jenkins SSH Plugin version 2.6.1 and earlier suffer from a missing authorization vulnerability. Attackers with Overall/Read permission can exploit this vulnerability to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method. This allows them to capture credentials stored in Jenkins. The vulnerability has a CVSS score of 7.1, indicating a high severity level. The CWE ID associated with this vulnerability is CWE-862.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the Jenkins SSH Plugin to the latest secure version as soon as possible.
Conclusion
The Jenkins SSH Plugin version 2.6.1 and earlier suffer from a missing authorization vulnerability that allows attackers with Overall/Read permission to connect to unauthorized SSH servers and capture credentials stored in Jenkins. To mitigate this risk, it is crucial to update the plugin to version 2.6.2 or later. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:ssh →
FAQ
The vulnerability allows attackers with Overall/Read permission to connect to an SSH server of their choice using specific credentials IDs. This can lead to unauthorized access to sensitive information stored in Jenkins.
No, this vulnerability requires attackers to have Overall/Read permission in Jenkins. Remote exploitation is not possible without prior access to the Jenkins instance.
There are no known instances of this vulnerability being exploited in the wild at the time of this report. However, it is crucial to update the plugin to mitigate the risk.
Yes, the CVSS score for this vulnerability is 7.1, indicating a high severity level.
Yes, the Jenkins SSH Plugin version 2.6.2 or later includes a fix for this vulnerability. Users should update to the latest version to ensure their Jenkins installation is secure.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:ssh.
