CVE-2022-25198

Vulnerability

A cross-site request forgery (CSRF) vulnerability exists in Jenkins SCP publisher Plugin version 1.8 and earlier [1]. This allows attackers to craft a malicious request that, when executed by a Jenkins user with appropriate permissions, changes the plugin configuration to connect to an attacker-specified SSH server using attacker-specified credentials.

Exploitation

To exploit this, an attacker must trick a Jenkins user (e.g., an administrator) into clicking a crafted link or visiting a malicious page while authenticated to Jenkins. The attacker then sends a CSRF request that modifies the plugin settings, specifying the SSH server and credentials under their control.

Impact

Successful exploitation enables the attacker to have the SCP publisher plugin connect to an attacker-controlled SSH server, potentially leading to unauthorized data transfer, exfiltration, or further compromise of the Jenkins environment.

Mitigation

The plugin is deprecated and no longer maintained [3]. As of February 2022, no fix is planned. The recommended mitigation is to uninstall the plugin if not required. Administrators can also enable CSRF protection in Jenkins, though the plugin may not fully honor it. Users should consider alternative methods for SCP transfers.