CVE-2022-34792

Vulnerability

A cross-site request forgery (CSRF) vulnerability exists in Jenkins Recipe Plugin version 1.2 and earlier [1][2]. The plugin does not require a valid CSRF token or other mechanism to validate the origin of HTTP requests, enabling an attacker to craft a malicious request that causes a Jenkins user (with sufficient permissions) to send an HTTP GET request to an attacker-specified URL and parse the response as XML. This affects all versions up to and including 1.2 of the recipe-plugin [3].

Exploitation

An attacker must trick an authenticated Jenkins user (who has at least Job/Read permission on a project that uses the Recipe Plugin) into clicking a crafted link or visiting a malicious web page. The attacker does not need any special network access or write capabilities within Jenkins itself [1]. The exploit triggers the Jenkins server to issue an HTTP GET request to an attacker-controlled URL and then process the returned content (which is parsed as XML) [1].

Impact

Successful exploitation allows the attacker to coerce a Jenkins instance into sending an HTTP request to an arbitrary URL (e.g., for internal service discovery or scanning) and to parse the XML response [1]. While the advisory does not detail the full consequences of XML parsing, it could potentially lead to information disclosure if the response contains sensitive data or further side effects if the XML parser processes external entities (SSRF or XXE) [1]. The attacker does not gain direct code execution, but the ability to control outbound requests and parse XML can be used for reconnaissance or chained with other vulnerabilities.

Mitigation

Jenkins Recipe Plugin 1.3 is not listed in the advisory as fixed; the advisory only states that version 1.2 and earlier are affected [1]. As of the advisory date (2022-06-30), no patched version was available [1]. Users should consider disabling the plugin if it is not required, or applying a workaround such as using the Content-Security-Policy HTTP header or network segmentation to limit outbound requests from the Jenkins controller [1]. The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.