CVE-2022-25177

Vulnerability

Jenkins Pipeline: Shared Groovy Libraries Plugin version 552.vd9cc05b8a2e1 and earlier follows symbolic links to locations outside of the expected Pipeline library when reading files using the libraryResource step [1][2]. This allows attackers able to configure Pipelines to read arbitrary files on the Jenkins controller file system [1][2].

Exploitation

An attacker must have the ability to configure Pipelines (e.g., Item/Configure permission) in order to exploit this vulnerability [1]. By crafting a Pipeline that uses the libraryResource step to read a file that is a symbolic link pointing outside the intended library directory, the attacker can cause the plugin to read arbitrary files on the controller's file system [1][2].

Impact

On successful exploitation, an attacker gains the ability to read arbitrary files from the Jenkins controller file system [1][2]. This could lead to disclosure of sensitive information such as credentials, configuration files, or source code stored on the controller.

Mitigation

Jenkins has released updated versions of the Pipeline: Shared Groovy Libraries Plugin that address this issue [1]. Users should upgrade to the latest version available from the Jenkins update center. No workarounds are provided in the available references [1][2].