CVE-2022-34789: Jenkins Matrix Reloaded Plugin CSRF Vulnerability
Summary
CVE-2022-34789: Jenkins Matrix Reloaded Plugin vulnerable to CSRF. Affects net.praqma:matrix-reloaded versions < 1.1.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Matrix Reloaded Plugin is a Maven package (net.praqma:matrix-reloaded) that provides functionality for managing matrix builds in Jenkins. Matrix builds allow for parallel execution of multiple configurations of a project. The plugin enables users to define axes and values for these configurations, facilitating efficient testing and deployment. However, versions 1.1.3 and earlier of the plugin are vulnerable to a cross-site request forgery (CSRF) attack.
Vulnerability Detail
The CSRF vulnerability in Jenkins Matrix Reloaded Plugin 1.1.3 and earlier arises from the plugin's lack of requirement for POST requests on an HTTP endpoint. This oversight allows attackers to forge requests that can rebuild previous matrix builds without proper authorization. By exploiting this vulnerability, malicious actors can manipulate the build process, potentially leading to unauthorized access, data corruption, or other security breaches.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the Jenkins Matrix Reloaded Plugin until the vulnerability is patched. This can be done by navigating to the Jenkins plugin management page, locating the Matrix Reloaded Plugin, and disabling it. However, this workaround may impact the functionality of matrix builds in Jenkins, so it is advisable to apply the recommended fix as soon as possible.
Conclusion
The Jenkins Matrix Reloaded Plugin version 1.1.3 and earlier is vulnerable to a CSRF attack, allowing unauthorized rebuilds of matrix builds. To mitigate this risk, it is recommended to upgrade to version 1.1.4 or later, which includes the necessary security patches. Alternatively, users can temporarily disable the plugin until the fix is applied. For additional support, please contact DevNack.com.
See every vulnerability recorded for net.praqma:matrix-reloaded →
FAQ
The vulnerability allows attackers to perform unauthorized rebuilds of previous matrix builds in Jenkins, potentially leading to security breaches, data corruption, or unauthorized access.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using just the pom.xml file, without requiring access to the code or installation.
The CVSS score of this vulnerability is 6.5, indicating a moderate severity level.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is crucial to apply the recommended fix or workaround to mitigate the risk.
For further support on vulnerability remediation or any other security concerns, you can reach out to info@devnack.com. Our team of experts is ready to assist you.
Related vulnerabilities
Recent vulnerabilities recorded for net.praqma:matrix-reloaded.
