CVE-2022-25182: High severity jenkins pipeline vulnerability
A flaw was found in Jenkins. The Pipeline: Shared Groovy Libraries Plugin uses the names of Pipeline libraries to create directories without canonicalization or sanitization. This flaw allows attackers with item/configure permission to execute arbitrary code in the context of the Jenkins controller, JVM, using specially crafted library names if a global Pipeline library is already configured.
Other sources
A sandbox bypass vulnerability in Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier allows attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller JVM using specially crafted library names if a global Pipeline library is already configured.
Jenkins Pipeline: Deprecated Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the names of Pipeline libraries to create directories without canonicalization or sanitization.
This allows attackers with Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM using specially crafted library names if a global Pipeline library is already configured.
Pipeline: Deprecated Groovy Libraries Plugin 561.vace0de3c2d69 sanitizes the names of Pipeline libraries when creating library directories.
Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the names of Pipeline libraries to create directories without canonicalization or sanitization. This allows attackers with Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM using specially crafted library names if a global Pipeline library is already configured.
References:
https://www.jenkins.io/security/advisory/2022-02-15/
— Red Hat
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2022-25182?
CVE-2022-25182 has a medium severity rating, indicating a moderate risk of exploitation.
How do I fix CVE-2022-25182?
To fix CVE-2022-25182, update the Pipeline: Shared Groovy Libraries Plugin to version 552.vd9cc05b8a2e1 or later.
Which versions of Jenkins are affected by CVE-2022-25182?
CVE-2022-25182 affects Jenkins versions prior to Pipeline: Shared Groovy Libraries Plugin version 552.vd9cc05b8a2e1.
What kind of attack can exploit CVE-2022-25182?
An attacker with item/configure permission can exploit CVE-2022-25182 to execute arbitrary code on the Jenkins controller.
Is CVE-2022-25182 a local or remote vulnerability?
CVE-2022-25182 is considered a local vulnerability as it requires authenticated access to exploit.