CVE-2022-28157

Vulnerability

The Pipeline: Phoenix AutoTest Plugin (versions 1.3 and earlier) for Jenkins contains a missing permission check vulnerability. Attackers who have obtained the Item/Configure permission can use the plugin's FTP functionality to upload arbitrary files from the Jenkins controller's filesystem to an attacker-controlled FTP server. This affects all versions up to and including 1.3 [1][2][3].

Exploitation

An attacker must have Item/Configure permission on a Jenkins job that uses the Phoenix AutoTest Plugin. The attacker can then craft a pipeline step, such as phoenixFtp, specifying an arbitrary file from the Jenkins controller as the source and an attacker-controlled FTP server as the destination. When the pipeline executes, the plugin will read the specified file and transfer it to the remote FTP server [1][3][4].

Impact

Successful exploitation allows an attacker to exfiltrate arbitrary files from the Jenkins controller filesystem, including sensitive configuration files, credentials, and other secrets. This can lead to further compromise of the Jenkins environment and any systems integrated with it [1][2][3].

Mitigation

As of the publication date (2022-03-29), no fixed version of the Pipeline: Phoenix AutoTest Plugin has been released, and the vulnerability remains unresolved [1][2]. Users are advised to restrict Item/Configure permission to trusted users, monitor for any suspicious FTP traffic from the Jenkins controller, and consider removing or disabling the plugin if it is not required [1][2].