CVE-2022-25178

Vulnerability

The Jenkins Pipeline: Shared Groovy Libraries Plugin, versions 552.vd9cc05b8a2e1 and earlier, does not restrict the names of resources passed to the libraryResource step. This allows an attacker who can configure Pipelines (i.e., has the Pipelines permission) to specify arbitrary file paths on the Jenkins controller file system, leading to reading arbitrary files. [1][2]

Exploitation

An attacker with the ability to configure Pipelines (typically granted by the Job/Configure permission) can craft a Pipeline script that uses the libraryResource step with a malicious resource name pointing to an arbitrary file path on the controller. The step will then read and return the contents of the file, which can be exfiltrated via the build output or other means. [1]

Impact

Successful exploitation allows the attacker to read arbitrary files from the Jenkins controller file system, including sensitive configuration files, credentials, and secrets. This can lead to a complete compromise of the Jenkins instance and its managed systems. [1][2]

Mitigation

Jenkins has released an updated version of the Pipeline: Shared Groovy Libraries Plugin that restricts resource names to a safe set. Users should upgrade to the latest version of the plugin. As of the advisory date, no version number is explicitly provided in the references, but the fix is available in the plugin's repository. [1][3]