CVE-2022-25181: High severity jenkins pipeline vulnerability
A flaw was found in Jenkins. The Pipeline: Shared Groovy Libraries Plugin uses the same workspace directory for all checkouts of Pipeline libraries with the same name, regardless of the SCM used and the source of the library configuration. This flaw allows attackers with item/configure permission to execute arbitrary code in the context of the Jenkins controller, JVM, through crafted SCM contents if a global Pipeline library already exists.
Other sources
A sandbox bypass vulnerability in Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier allows attackers with Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM through crafted SCM contents, if a global Pipeline library already exists.
Jenkins Pipeline: Deprecated Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the same workspace directory for all checkouts of Pipeline libraries with the same name regardless of the SCM being used and the source of the library configuration.
This allows attackers with Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM through crafted SCM contents, if a global Pipeline library already exists.
Pipeline: Deprecated Groovy Libraries Plugin 561.vace0de3c2d69 uses distinct checkout directories per SCM for Pipeline libraries.
Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the same workspace directory for all checkouts of Pipeline libraries with the same name regardless of the SCM being used and the source of the library configuration. This allows attackers with Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM through crafted SCM contents, if a global Pipeline library already exists.
References:
https://www.jenkins.io/security/advisory/2022-02-15/
— Red Hat
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2022-25181?
CVE-2022-25181 has been classified as a medium severity vulnerability.
How do I fix CVE-2022-25181?
To fix CVE-2022-25181, you should upgrade to a version of the Jenkins Pipeline: Shared Groovy Libraries Plugin that is not affected, specifically versions later than 552.vd9cc05b8a2e1.
What applications are affected by CVE-2022-25181?
CVE-2022-25181 affects Jenkins and specifically the Pipeline: Shared Groovy Libraries Plugin.
What type of vulnerability is CVE-2022-25181?
CVE-2022-25181 is a directory traversal vulnerability related to workspace directory usage in Jenkins.
Can attackers exploit CVE-2022-25181 remotely?
CVE-2022-25181 requires attackers to have item/configure permissions, indicating a need for authenticated access.