CVE-2022-23107

Vulnerability

Jenkins Warnings Next Generation Plugin versions 9.10.2 and earlier contain a path traversal vulnerability in the custom ID configuration for tools. When configuring a tool, users can set a custom ID that is used to generate a file name on the Jenkins controller file system. The plugin appends a hard-coded suffix (e.g., .xml or similar) but does not validate or sanitize the ID input. This allows an attacker to specify a name that includes directory traversal sequences (../) or arbitrary paths, resulting in the creation or reading of files outside the intended directory. [1][2]

Exploitation

An attacker must have the Item/Configure permission on a Jenkins job. By editing the configuration of a tool within a job (e.g., a static analysis tool), the attacker can set the custom ID field to a malicious path, such as ../../somefile. When the plugin writes or reads the file associated with that tool, it will use the attacker-controlled path combined with the fixed suffix. No additional authentication or user interaction is required beyond the initial configuration. The attack can be performed directly from the Jenkins web UI. [1]

Impact

Successful exploitation allows the attacker to write arbitrary files (with the hard-coded suffix) or read arbitrary files (also with the suffix) on the Jenkins controller file system. The file contents are partially controlled: the written content is the tool's configuration data, and the read content is the file's contents. This can lead to disclosure of sensitive information (e.g., credentials stored in configuration files) or, by overwriting critical files, may allow privilege escalation to remote code execution. The attacker gains the ability to affect files outside the plugin's intended scope. [1]

Mitigation

The vulnerability is fixed in Warnings Next Generation Plugin version 9.10.3, released on January 12, 2022. Users should upgrade to 9.10.3 or later. No workaround is provided in the advisory. The plugin is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. [1][2]