PT-2022-22044 · Jenkins · Jenkins Pipeline: Input Step Plugin+1

Daniel Beck · Published 2022-06-22 · Updated 2023-11-03 · CVE-2022-34177

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Pipeline: Input Step Plugin versions 448.v37cea 9a 10a 70 and earlier

Description The issue allows attackers who can configure Pipelines to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content. This is because the plugin archives files uploaded for file parameters for Pipeline input steps on the controller as part of build metadata, using the parameter name without sanitization as a relative path inside a build-related directory.

Recommendations For Jenkins Pipeline: Input Step Plugin versions 448.v37cea 9a 10a 70 and earlier, update to version 449.v77f0e8b 845c4 or later, which prohibits the use of file parameters for Pipeline input steps. As a temporary workaround, consider restricting the ability to configure Pipelines to trusted users until the update is applied.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-34177

GHSA-29Q6-P2CG-4V23

RHSA-2022:6531

RHSA-2022:9110

RHSA-2023:0017

Affected Products

Jenkins

Jenkins Pipeline: Input Step Plugin

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-34177 · Security Note
• https://osv.dev/vulnerability/CVE-2022-34177 · Vendor Advisory
• https://jenkins.io/security/advisory/2022-06-22/#SECURITY-2705 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-29q6-p2cg-4v23 · Vendor Advisory
• https://github.com/jenkinsci/pipeline-input-step-plugin/commit/77f0e8b845c4ad429f6c717eab21cf4e7a69168e · Note
• https://github.com/jenkinsci/pipeline-input-step-plugin · Note
• https://t.me/cibsecurity/45037 · Telegram Post