CVE-2022-36890

Vulnerability

The Jenkins Deployer Framework Plugin, versions 85.v1d1888e8c021 and earlier, does not validate or restrict the name of files used in methods that implement form validation. This lack of input sanitization allows an attacker to specify arbitrary file paths in these validation requests [1].

Exploitation

An attacker must have at least Item/Read permission to exploit this vulnerability. By crafting a request with a malicious file path, the attacker can send a form validation method that checks for the existence of that file on the Jenkins controller's file system. The plugin's response reveals whether the file exists or not [1][2].

Impact

Successful exploitation enables an attacker to enumerate files on the Jenkins controller, potentially discovering sensitive files such as credentials, configuration files, or other secrets. While it does not allow reading file contents, the existence check itself can aid in further attacks or reconnaissance [1].

Mitigation

The vulnerability is fixed in Deployer Framework Plugin version 86.v7b_a_4a_55b_f3ec and later. Users should upgrade to this version immediately. No workarounds are available if the plugin cannot be updated [2].