CVE-2022-41234: Missing webhook endpoint authorization in Jenkins Rundeck Plugin
Summary
CVE-2022-41234: Missing webhook endpoint authorization in Jenkins Rundeck Plugin. Affects org.jenkins-ci.plugins:rundeck versions < 3.6.12. Fixed in 3.6.12. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Rundeck Plugin is a plugin for the Jenkins automation server that allows users to trigger jobs configured to be triggerable via Rundeck. It provides integration between Jenkins and Rundeck, enabling users to execute Rundeck jobs from Jenkins. The plugin is commonly used in CI/CD pipelines to automate deployment and orchestration tasks. However, versions 3.6.11 and earlier of the plugin have a vulnerability that exposes the /plugin/rundeck/webhook/ endpoint, allowing users with Overall/Read permission to trigger jobs via Rundeck.
Vulnerability Detail
The vulnerability in Jenkins Rundeck Plugin 3.6.11 and earlier stems from the lack of access protection for the /plugin/rundeck/webhook/ endpoint. This means that any user with Overall/Read permission can trigger jobs that are configured to be triggerable via Rundeck, regardless of their actual authorization level. This can lead to unauthorized execution of jobs and potential security breaches. The vulnerability has a CVSS score of 5.4, indicating a moderate severity level.
How To Fix
Minimum fixed version
3.6.12
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the /plugin/rundeck/webhook/ endpoint by modifying the Jenkins server's access control configuration. This can be done by denying access to the endpoint for users with Overall/Read permission. Here is an example of how to achieve this using the Jenkins Script Console:
import jenkins.security.MasterKillSwitch
MasterKillSwitch masterKillSwitch = MasterKillSwitch.getInstance()
masterKillSwitch.disable()
Conclusion
The Jenkins Rundeck Plugin 3.6.11 and earlier versions have a vulnerability that allows unauthorized users to trigger jobs via Rundeck. To mitigate this issue, it is recommended to upgrade to version 3.6.12 or later of the plugin. Alternatively, you can apply a temporary workaround by restricting access to the /plugin/rundeck/webhook/ endpoint. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:rundeck →
FAQ
The vulnerability allows users with Overall/Read permission to trigger jobs via Rundeck, regardless of their actual authorization level. This can lead to unauthorized execution of jobs and potential security breaches.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins Rundeck Plugin version is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time and alert you if any open-source vulnerabilities, including this one, are found.
Yes, a fix is available for this vulnerability. It is recommended to upgrade to version 3.6.12 or later of the Jenkins Rundeck Plugin to mitigate the issue.
Yes, a temporary workaround is available. You can restrict access to the /plugin/rundeck/webhook/ endpoint by modifying the Jenkins server's access control configuration to deny access for users with Overall/Read permission. Refer to the 'workaround' section for more details.
You can find more information about this vulnerability, including the CVE identifier (CVE-2022-41234), in the GitHub Advisory Database (https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/09/GHSA-qgv4-7jhx-c72q/GHSA-qgv4-7jhx-c72q.json).
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:rundeck.
