CVE-2022-28147

Vulnerability

A missing permission check in the Jenkins Continuous Integration with Toad Edge Plugin, versions 2.3 and earlier, enables attackers who have Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system [1][2][3]. The plugin does not perform any additional authorization when handling the file path existence check endpoint, making the code path reachable by any user with the minimal Overall/Read permission.

Exploitation

An attacker needs only to have Overall/Read permission on the Jenkins instance, which is a default permission for many users. No additional authentication or write access is required. The attacker can send a crafted request with an arbitrary file path to the vulnerable endpoint. The plugin then internally checks for the file's existence and returns a response indicating whether the path exists [1][3]. No user interaction or race condition is needed.

Impact

On success, the attacker can probe for the existence of arbitrary files and directories on the Jenkins controller file system. This is an information disclosure vulnerability that reveals whether a given file path exists, potentially aiding in reconnaissance for further attacks. The attacker does not gain the ability to read file contents or modify files. The compromise is limited to existence checking but can expose critical information such as the presence of credentials files, configuration files, or other sensitive paths [1][3].

Mitigation

Continuous Integration with Toad Edge Plugin version 2.4 fixes the missing permission check by adding proper authorization [1][2]. Users should upgrade to version 2.4 or later immediately. No workarounds are available, as the vulnerable endpoint cannot be disabled without upgrading. The plugin is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog as of the publication date.