CVE-2022-34797

Vulnerability

Overview

A cross-site request forgery (CSRF) vulnerability exists in Jenkins Deployment Dashboard Plugin versions 1.0.10 and earlier. The plugin fails to validate or require a CSRF token for a specific form submission, allowing an attacker to trick a Jenkins user into performing unintended actions [1][2].

Exploitation

An attacker can craft a malicious web page or email that, when visited by an authenticated Jenkins user with appropriate permissions, triggers a forged request to the Jenkins server. This request causes the plugin to connect to an attacker-specified HTTP URL using attacker-supplied credentials. No additional authentication is required from the attacker beyond luring the victim [1].

Impact

Successful exploitation enables the attacker to make the Jenkins server initiate outbound HTTP connections to arbitrary URLs, potentially exfiltrating sensitive data, interacting with internal services, or performing actions on external systems using attacker-controlled credentials. The impact depends on the network position of the Jenkins server and the credentials provided [2].

Mitigation

The vulnerability is fixed in a subsequent release of the Deployment Dashboard Plugin. Users should upgrade to the latest version as recommended in the Jenkins security advisory. No workarounds are documented [1].