CVE-2022-25208

Vulnerability

The Jenkins Chef Sinatra Plugin versions 1.20 and earlier lack a permission check in a certain functionality. This allows users with Overall/Read permission (the lowest access level) to trigger the plugin to send an HTTP request to an attacker-specified URL and parse the XML response. [1][3]

Exploitation

An attacker with Overall/Read permission can craft a request to the plugin that includes a URL under their control. Jenkins will then send an HTTP GET request to that URL and parse the returned XML content. No additional authentication or user interaction is required beyond having the Overall/Read permission. [1]

Impact

Successful exploitation enables the attacker to make Jenkins initiate outbound HTTP connections to arbitrary hosts, potentially leading to server-side request forgery (SSRF) or information disclosure if the XML parser processes external entities. The exact impact depends on the network environment and the XML parser's configuration. [1][3]

Mitigation

As of the advisory date (2022-02-15), no fix has been released for the Chef Sinatra Plugin. The plugin is listed as having an unresolved security issue. Users are advised to disable or remove the plugin if not needed, or restrict network access from the Jenkins controller to untrusted hosts. [1][2]