PT-2022-27487 · Cloudbees+1 · Jenkins Cloudbees Docker Hub/Registry Notification Plugin+1
Kevin Guerroudj
·
Published
2022-11-15
·
Updated
2023-11-13
·
CVE-2022-45385
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Jenkins CloudBees Docker Hub/Registry Notification Plugin versions 2.6.2 and earlier
Description
A missing permission check in the Jenkins CloudBees Docker Hub/Registry Notification Plugin allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository. The plugin provides several webhook endpoints that can be used to trigger builds when Docker images used by a job have been rebuilt, and these endpoints can be accessed without authentication. This enables unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository.
Recommendations
For Jenkins CloudBees Docker Hub/Registry Notification Plugin versions 2.6.2 and earlier, update to version 2.6.2.1 or later, which requires a token as part of webhook URLs, acting as authentication for the webhook endpoint. As a temporary workaround, consider setting the Java system property
org.jenkinsci.plugins.registry.notification.webhook.JSONWebHook.DO NOT REQUIRE API TOKEN to false to enable the requirement for an API token, but be aware that setting it to true would disable this security fix.Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Jenkins
Jenkins Cloudbees Docker Hub/Registry Notification Plugin