PT-2022-27483 · Jenkins+1 · Jenkins Pipeline Utility Steps Plugin+2

James Nord · Published 2022-11-15 · Updated 2023-11-22 · CVE-2022-45381

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Pipeline Utility Steps Plugin versions 2.13.1 and earlier

Description The issue allows attackers who can configure Pipelines to read arbitrary files from the Jenkins controller file system. This is due to the lack of restriction on the set of enabled prefix interpolators and the inclusion of Apache Commons Configuration library versions that enable the file: prefix interpolator by default.

Recommendations For Jenkins Pipeline Utility Steps Plugin versions 2.13.1 and earlier, update to version 2.13.2 or later, which restricts the set of prefix interpolators enabled by default. As a temporary workaround, consider setting the Java system property org.jenkinsci.plugins.pipeline.utility.steps.conf.ReadPropertiesStepExecution.CUSTOM PREFIX INTERPOLATOR LOOKUPS to customize which prefix interpolators are enabled, excluding the file: prefix interpolator.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-45381

GHSA-3G9Q-CMGV-G4P6

RHSA-2023:0560

RHSA-2023:0777

Affected Products

Apache Commons Configuration

Jenkins

Jenkins Pipeline Utility Steps Plugin

References · 9

• https://osv.dev/vulnerability/GHSA-3g9q-cmgv-g4p6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-45381 · Security Note
• https://osv.dev/vulnerability/CVE-2022-45381 · Vendor Advisory
• https://jenkins.io/security/advisory/2022-11-15/#SECURITY-2949 · Vendor Advisory
• https://github.com/jenkinsci/pipeline-utility-steps-plugin · Note
• https://github.com/jenkinsci/pipeline-utility-steps-plugin/commit/01be8ac0045027128fc1e9cf3a8b0709d08291ea · Note
• http://openwall.com/lists/oss-security/2022/11/15/4 · Note
• https://t.me/cvenotify/38085 · Telegram Post
• https://t.me/cvenotify/37793 · Telegram Post