CVE-2022-30971: XML External Entity Reference in Jenkins Storable Configs Plugin
Summary
CVE-2022-30971: XML External Entity Reference in Jenkins Storable Configs Plugin. Affects org.jvnet.hudson.plugins:storable-configs-plugin versions < 1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Storable Configs Plugin is a Maven package (org.jvnet.hudson.plugins:storable-configs-plugin) used in Jenkins, an open-source automation server. This plugin allows users with Item/Configure permission to store and retrieve configuration data for Jenkins items. It provides a convenient way to manage and persist configuration settings. However, versions 1.0 and earlier of the plugin are vulnerable to XML external entity (XXE) attacks.
Vulnerability Detail
The vulnerability in the Jenkins Storable Configs Plugin arises from the lack of proper configuration of the XML parser, which makes it susceptible to XXE attacks. An attacker with Item/Configure permission can exploit this vulnerability by uploading a specially crafted file that contains external entities. These entities can be used to extract sensitive information from the Jenkins controller or perform server-side request forgery (SSRF) attacks. The impact of this vulnerability can be significant, as it allows unauthorized access to sensitive data and potential manipulation of the Jenkins server.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can restrict Item/Configure permission to trusted individuals only. By limiting access to this permission, the risk of exploitation can be reduced. However, this workaround may not be feasible in all scenarios, especially in environments where multiple users require Item/Configure permission.
Conclusion
The XML External Entity Reference vulnerability in the Jenkins Storable Configs Plugin can lead to unauthorized access to sensitive information and potential server-side request forgery attacks. It is crucial to upgrade to a non-vulnerable version of the plugin and regularly update Jenkins and its plugins to mitigate this risk. For further assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jvnet.hudson.plugins:storable-configs-plugin →
FAQ
The vulnerability allows attackers with Item/Configure permission to extract sensitive information from the Jenkins controller or perform server-side request forgery (SSRF) attacks.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins installation is affected by this vulnerability. Simply provide the pom.xml file of your Jenkins project, and Vulert will analyze it for open-source vulnerabilities in real-time.
Yes, upgrading to a version of the Jenkins Storable Configs Plugin that is not affected by this vulnerability will resolve the issue. Make sure to regularly update Jenkins and its plugins to stay protected against security vulnerabilities.
As a temporary workaround, you can restrict Item/Configure permission to trusted individuals only. However, this may not be a feasible solution in all scenarios.
For more information about this vulnerability, you can refer to the GitHub Security Advisory Database (https://github.com/github/advisory-database) and search for the advisory with the ID GHSA-wqmp-2p5r-rhfv.
Related vulnerabilities
Recent vulnerabilities recorded for org.jvnet.hudson.plugins:storable-configs-plugin.
