CVE-2022-43407: CSRF Bypass in Jenkins Pipeline: Input Step Plugin
Summary
CVE-2022-43407: CSRF protection for any URL can be bypassed in Jenkins Pipeline: Input Step Plugin. Affects org.jenkins-ci.plugins:pipeline-input-step versions < 456.vd8a_957db_5b_e9. Fixed in 456.vd8a_957db_5b_e9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Pipeline: Input Step Plugin is a component of the Jenkins automation server that allows users to define interactive steps in their pipeline scripts. These interactive steps, known as 'input' steps, enable users to pause the pipeline execution and prompt for user input before proceeding. The plugin provides a mechanism for CSRF (Cross-Site Request Forgery) protection to prevent unauthorized access to sensitive URLs in Jenkins. However, versions 451.vf1a_a_4f405289 and earlier of the plugin have a vulnerability that allows the bypassing of CSRF protection for any URL specified in the 'input' step ID.
Vulnerability Detail
The vulnerability arises from the lack of restrictions or sanitization of the 'input' step ID in the Pipeline: Input Step Plugin. Attackers with the ability to configure Pipelines can craft 'input' step IDs that would bypass the CSRF protection of any target URL in Jenkins when the 'input' step is interacted with. This can lead to unauthorized access and potential security breaches in Jenkins. The issue has been assigned a CVSS score of 8.8, indicating a high severity.
How To Fix
Minimum fixed version
456.vd8a_957db_5b_e9
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the affected plugin to the latest version as soon as possible.
Conclusion
The CSRF bypass vulnerability in the Pipeline: Input Step Plugin can have severe consequences, including unauthorized access and security breaches in Jenkins. It is crucial to update the affected plugin to the latest version (456.vd8a_957db_5b_e9 or later) to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:pipeline-input-step →
FAQ
This vulnerability allows attackers to bypass CSRF protection in Jenkins, potentially leading to unauthorized access and security breaches.
Versions 451.vf1a_a_4f405289 and earlier of the Pipeline: Input Step Plugin are affected.
There are no known public exploits for this vulnerability at the time of this report.
Yes, updating the Pipeline: Input Step Plugin to version 456.vd8a_957db_5b_e9 or later fixes this vulnerability.
No, this vulnerability requires a plugin update to be fully resolved.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:pipeline-input-step.
