CVE-2022-27198

Vulnerability

A cross-site request forgery (CSRF) vulnerability exists in the Jenkins CloudBees AWS Credentials Plugin versions 189.v3551d5642995 and earlier. This allows an attacker to perform actions on behalf of a victim user without their consent, specifically to connect to an AWS service using an attacker-specified token. The vulnerability requires that the target user has Overall/Read permission [1][2].

Exploitation

An attacker can craft a malicious web page or link that, when accessed by an authenticated Jenkins user with Overall/Read permission, triggers a cross-site request to the Jenkins server. This request uses the victim's session to modify AWS credentials configuration, enabling the attacker to substitute their own AWS token. No special network position is required; the attacker only needs to trick the victim into interacting with the malicious content [1][2].

Impact

Successful exploitation allows the attacker to connect to any AWS service using the attacker-specified token, potentially gaining unauthorized access to AWS resources. The attacker can leverage the victim's Jenkins permissions to perform actions that the victim is authorized for, but with the attacker's own AWS credentials, leading to data exposure or misuse of AWS services [1][2].

Mitigation

The vulnerability is fixed in CloudBees AWS Credentials Plugin version 191.vcb_f183ce58b_9, released on 2022-03-15 [2]. Users should upgrade to this version or later. There is no known workaround; disabling the plugin or restricting Overall/Read permission can reduce risk but may impact functionality [1][2].