CVE-2022-41232: Jenkins Build-Publisher Plugin Cross-Site Request Forgery
Summary
CVE-2022-41232: Jenkins build-publisher plugin vulnerable to cross-site request forgery. Affects org.jenkins-ci.plugins:build-publisher versions < 1.22. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Build-Publisher Plugin is a Maven package that provides functionality for publishing build artifacts to external systems. It allows users to configure various settings for publishing, such as target locations and authentication credentials. This plugin is commonly used in Jenkins CI/CD pipelines to automate the deployment of build artifacts. However, versions 1.22 and earlier of the plugin are vulnerable to a cross-site request forgery (CSRF) attack.
Vulnerability Detail
The vulnerability in the Jenkins Build-Publisher Plugin allows attackers to perform a CSRF attack by exploiting an API endpoint. By providing a crafted file name, an attacker can replace any config.xml file on the Jenkins controller file system with an empty file. This can lead to various security issues, such as unauthorized access, data loss, or disruption of the Jenkins build process. The vulnerability has a CVSS score of 8.0, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is currently no specific workaround provided for this vulnerability. However, removing or disabling the Jenkins Build-Publisher Plugin can mitigate the risk of exploitation. This can be done by navigating to the Jenkins plugin management page, locating the Build-Publisher Plugin, and either uninstalling or deactivating it.
Conclusion
The Jenkins Build-Publisher Plugin is vulnerable to a cross-site request forgery (CSRF) attack, allowing attackers to replace config.xml files on the Jenkins controller file system. As of now, there is no official patch available, and the plugin has been suspended. It is recommended to remove or disable the plugin until a fix is released. Stay updated with the plugin maintainers and apply the latest version once it becomes available. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:build-publisher →
FAQ
The vulnerability allows an attacker to replace any config.xml file on the Jenkins controller file system with an empty file. This can lead to unauthorized access, data loss, or disruption of the Jenkins build process.
No, there is currently no official patch available for this vulnerability. The Jenkins Build-Publisher Plugin has been suspended, and users are advised to remove or disable the plugin until a fix is released.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins environment is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for any open-source vulnerabilities, including CVE-2022-41232.
No, the recommended mitigation is to remove or disable the Jenkins Build-Publisher Plugin. This is necessary to prevent the exploitation of the vulnerability. Once a patch is released, it is advisable to update the plugin to the latest version.
For more information about this vulnerability, you can refer to the GitHub Security Advisory Database entry at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/09/GHSA-phr4-94xx-259m/GHSA-phr4-94xx-259m.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:build-publisher.
