CVE-2022-36907

Vulnerability

Details

CVE-2022-36907 is a missing permission check vulnerability in the Jenkins OpenShift Deployer Plugin versions 1.2.0 and earlier [1][3]. The plugin fails to properly validate that users have the necessary permissions before allowing them to connect to an arbitrary URL using attacker-specified username and password. This means that any user with the default 'Overall/Read' permission can trigger an outbound connection from the Jenkins controller to a host and port chosen by the attacker, using credentials the attacker supplies [1].

Exploitation and

Impact

The attack requires only that the attacker has Overall/Read access to a Jenkins instance [3]. An authenticated attacker can craft a malicious request that causes the plugin to connect to an attacker-controlled server using attacker-provided credentials. This can be leveraged to perform Server-Side Request Forgery (SSRF) attacks, potentially accessing internal network resources that the Jenkins controller can reach, or to attempt credential guessing against other services if the attacker can observe the connection attempt [1][2]. The vulnerability does not require any special privileges beyond the minimal read-level access that many Jenkins users have.

Mitigation

The Jenkins Security Advisory 2022-07-27 does not list a fixed version for OpenShift Deployer Plugin, indicating that the plugin may be end-of-life or no longer maintained [2]. Users should consider removing or disabling the plugin if it is not essential, or restrict Overall/Read permissions to trusted users only. No patch has been released for this issue.