CVE-2022-36889: Jenkins Deployer Framework Plugin Arbitrary File Upload
Summary
CVE-2022-36889: Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the application path of the applications when configuring a deployment, allowing attackers with Item/Configure permission to upload arbitra... Affects org.jenkins-ci.plugins:deployer-framework versions < 86.v7b_a_4a_55b_f3ec. Fixed in 86.v7b_a_4a_55b_f3ec. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Deployer Framework Plugin is a Maven package that provides functionality for deploying applications. It allows users to configure deployments and upload files to a selected service. The plugin is commonly used in Jenkins CI/CD pipelines to automate the deployment process. However, versions 85.v1d1888e8c021 and earlier of the plugin have a vulnerability that allows attackers with Item/Configure permission to upload arbitrary files from the Jenkins controller file system to the selected service.
Vulnerability Detail
The vulnerability in the Jenkins Deployer Framework Plugin arises from the lack of application path restriction when configuring a deployment. This means that an attacker with the necessary permissions can upload any file from the Jenkins controller file system to the selected service. This could lead to various security risks, such as unauthorized access to sensitive information, execution of malicious code, or disruption of the deployment process. The vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
How To Fix
Minimum fixed version
86.v7b_a_4a_55b_f3ec
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the plugin is not immediately feasible, a temporary workaround is to restrict the permissions of users who have Item/Configure access. By limiting the number of users with this permission and ensuring they are trusted, the risk of exploitation can be reduced. Additionally, monitoring the Jenkins controller file system for any unauthorized file uploads can help detect and mitigate potential attacks.
Conclusion
The Jenkins Deployer Framework Plugin has a vulnerability that allows attackers to upload arbitrary files from the Jenkins controller file system. To mitigate this risk, it is recommended to update the plugin to the latest version or apply the provided workaround. Regular monitoring of the Jenkins controller file system and limiting the permissions of users with Item/Configure access can also help prevent exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:deployer-framework →
FAQ
The vulnerability allows attackers to upload arbitrary files from the Jenkins controller file system to the selected service. This can lead to unauthorized access, execution of malicious code, or disruption of the deployment process.
Users of Jenkins Deployer Framework Plugin versions 85.v1d1888e8c021 and earlier are affected by this vulnerability.
There are no known public exploits for this vulnerability at the time of this report. However, it is important to apply the recommended fix or workaround to mitigate the risk.
No, this vulnerability requires an attacker to have Item/Configure permission in Jenkins, which typically requires local or authenticated access.
Yes, the CVSS score for this vulnerability is 6.5, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:deployer-framework.
