PT-2022-17148 · Jenkins · Jenkins Chef Sinatra Plugin+1

Daniel Beck · Published 2022-02-15 · Updated 2023-11-03 · CVE-2022-25209

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Chef Sinatra Plugin versions 1.20 and earlier

Description The issue arises from the plugin not configuring its XML parser to prevent XML external entity (XXE) attacks, allowing attackers to have Jenkins parse a crafted XML response for extraction of secrets from the Jenkins controller or server-side request forgery. Additionally, the plugin does not perform a permission check in a method implementing form validation.

Recommendations For versions 1.20 and earlier, as a temporary workaround, consider disabling the XML parser functionality until a patch is available. Restrict access to the plugin to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2022-25209

GHSA-38W8-H222-WRPP

Affected Products

Jenkins

Jenkins Chef Sinatra Plugin

References · 6

• https://osv.dev/vulnerability/CVE-2022-25209 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25209 · Security Note
• https://jenkins.io/security/advisory/2022-02-15/#SECURITY-1377 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-38w8-h222-wrpp · Vendor Advisory
• https://t.me/cibsecurity/37526 · Telegram Post
• https://t.me/cvenotify/27228 · Telegram Post