CVE-2022-25176

Vulnerability

Jenkins Pipeline: Groovy Plugin versions 2648.va9433432b33c and earlier follow symbolic links to locations outside of the checkout directory for the configured SCM when reading the script file (typically Jenkinsfile) for Pipelines. This allows attackers with Item/Configure permission to read arbitrary files on the Jenkins controller file system [1][2].

Exploitation

An attacker must have Item/Configure permission to configure a Pipeline. By crafting a Pipeline that uses a script file (Jenkinsfile) containing symbolic links pointing to files outside the checkout directory, the attacker can cause the plugin to follow the symlink and read the target file [1][2].

Impact

Successful exploitation allows the attacker to read arbitrary files from the Jenkins controller file system, leading to information disclosure. The attacker is limited to reading files that the Jenkins controller process has access to [1][2].

Mitigation

The vulnerability is fixed in Pipeline: Groovy Plugin version 2656.vf7a_e7b_75a_457, which uses distinct checkout directories per SCM when reading the script file [1]. Users should upgrade to this version or later. As a workaround, restrict Item/Configure permission to trusted users only [1].