CVE-2022-36913

Vulnerability

Overview

Jenkins Openstack Heat Plugin versions 1.5 and earlier fail to perform permission checks in methods that implement form validation. This flaw allows any authenticated user with the Overall/Read permission to send crafted requests to these endpoints and determine whether a specified file path exists on the Jenkins controller's file system [1][4].

Exploitation

An attacker needs only the Overall/Read permission, which is typically granted to many users in a Jenkins environment. By submitting a form validation request with a target file path, the attacker can observe the response to infer the file's existence. No additional privileges or network position are required beyond access to the Jenkins web interface [1].

Impact

Successful exploitation enables an attacker to map the controller's file system, identifying the presence of sensitive files such as configuration files, credentials, or plugin artifacts. While this does not directly allow file content disclosure, it provides reconnaissance that can be leveraged in further attacks [4].

Mitigation

As of the advisory publication date (2022-07-27), no fixed version of the Openstack Heat Plugin has been announced. Administrators should restrict the Overall/Read permission to trusted users only, or consider removing the plugin if it is not essential. The Jenkins security advisory lists this issue as unresolved [1].