PT-2022-17146 · Jenkins · Jenkins Chef Sinatra Plugin+1

Daniel Beck · Published 2022-02-15 · Updated 2023-11-03 · CVE-2022-25207

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Chef Sinatra Plugin versions 1.20 and earlier

Description A cross-site request forgery (CSRF) vulnerability allows attackers to have Jenkins send an HTTP request to an attacker-controlled URL and parse an XML response. The plugin does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to exploit this issue. Furthermore, the plugin's XML parser is not configured to prevent XML external entity (XXE) attacks, enabling attackers to extract secrets from the Jenkins controller or perform server-side request forgery. The form validation method is also vulnerable to CSRF attacks as it does not require POST requests.

Recommendations For Jenkins Chef Sinatra Plugin versions 1.20 and earlier, as a temporary workaround, consider disabling the form validation method until a patch is available. Restrict access to the plugin's XML parser to minimize the risk of XXE attacks. Avoid using the plugin to parse XML responses from untrusted sources until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2022-25207

GHSA-X92V-XV3X-9V29

Affected Products

Jenkins

Jenkins Chef Sinatra Plugin

References · 6

• https://osv.dev/vulnerability/GHSA-x92v-xv3x-9v29 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-25207 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25207 · Security Note
• https://jenkins.io/security/advisory/2022-02-15/#SECURITY-1377 · Vendor Advisory
• https://github.com/jenkinsci/sinatra-chef-builder-plugin · Note
• http://openwall.com/lists/oss-security/2022/02/15/2 · Note