CVE-2022-45390: Missing permission check in Jenkins loader.io Plugin allows enumerating credentials IDs
Summary
CVE-2022-45390: Missing permission check in Jenkins loader.io Plugin allows enumerating credentials IDs. Affects io.loader:loaderio-jenkins-plugin versions < 1.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The loader.io Plugin is a Maven package (io.loader:loaderio-jenkins-plugin) used in Jenkins, an open-source automation server. This plugin allows users to load test their applications using the loader.io service. It provides functionality to configure and manage credentials for authentication purposes. However, a vulnerability has been identified in versions 1.0.1 and earlier of the plugin, which allows attackers with Overall/Read permission to enumerate credentials IDs stored in Jenkins. This can be exploited in conjunction with other vulnerabilities to capture the credentials and potentially gain unauthorized access to sensitive information or perform malicious actions.
Vulnerability Detail
The vulnerability in the loader.io Plugin arises from a missing permission check in an HTTP endpoint. Due to this oversight, attackers with Overall/Read permission can exploit the endpoint to enumerate credentials IDs. By obtaining these IDs, attackers can then leverage other vulnerabilities or techniques to capture the corresponding credentials. The impact of this vulnerability depends on the sensitivity of the credentials stored in Jenkins and the privileges associated with them. If successful, an attacker could gain unauthorized access to sensitive resources, compromise the integrity of the system, or perform unauthorized actions.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no official fix available, a possible workaround is to disable or remove the loader.io Plugin from the Jenkins instance until a patch or updated version is released. This can be done by navigating to the Jenkins plugin management interface and deactivating or uninstalling the plugin. However, this workaround may impact the functionality provided by the plugin, so it should be evaluated based on the specific needs of the Jenkins environment.
Conclusion
The loader.io Plugin vulnerability in Jenkins exposes a potential security risk by allowing attackers to enumerate credentials IDs. While there is no fix available at the time of this advisory, it is crucial to monitor the official GitHub repository for updates and apply any patches or new versions released by the maintainers. Consider implementing the suggested workaround of disabling or removing the plugin until a fix is available. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for io.loader:loaderio-jenkins-plugin →
FAQ
The vulnerability allows attackers with Overall/Read permission to enumerate credentials IDs stored in Jenkins. This can be used as part of an attack to capture the credentials and potentially gain unauthorized access to sensitive information or perform malicious actions.
Versions 1.0.1 and earlier of the loader.io Plugin are confirmed to be affected by this vulnerability.
As of the publication of this advisory, there is no fix available for the loader.io Plugin vulnerability. It is recommended to monitor the official GitHub repository for updates and apply any patches or new versions released by the maintainers.
While there is no official fix available, a possible workaround is to disable or remove the loader.io Plugin from the Jenkins instance until a patch or updated version is released. However, this may impact the functionality provided by the plugin and should be evaluated based on the specific needs of the Jenkins environment.
Attackers with Overall/Read permission in Jenkins can exploit the vulnerability to enumerate credentials IDs.
