CVE-2022-34200

Vulnerability

Overview

Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier is affected by a cross-site request forgery (CSRF) vulnerability. The plugin fails to require a confirmation token or any CSRF protection when performing certain actions, allowing an attacker to trick a legitimate Jenkins user into executing unwanted requests [1][2].

Exploitation

An attacker can exploit this CSRF flaw by crafting a malicious web page or link that, when visited by an authenticated Jenkins user, sends a forged request to the Jenkins server. This request can cause the plugin to connect to an attacker-specified URL, potentially leaking sensitive information or performing unintended operations [1]. No additional authentication is needed beyond the victim's active session.

Impact

Successful exploitation enables an attacker to make the Jenkins instance communicate with an external server under the attacker's control. This could be used to exfiltrate build data, credentials, or other secrets, or to stage further attacks within the Jenkins environment [1][2].

Mitigation

The Convertigo Mobile Platform Plugin has likely been fixed in versions after 1.1; users should upgrade to the latest available version. Jenkins also recommends enabling CSRF protection globally and using secure defaults for all plugins [1][3].