CVE-2022-36917

Vulnerability

The Jenkins Google Cloud Backup Plugin versions 0.6 and earlier contain a missing permission check in its backup functionality. This flaw allows any authenticated user with the Overall/Read permission to request a manual backup without proper authorization [1][2].

Exploitation

An attacker needs only the Overall/Read permission, which is a low-privilege access level often granted to many users in Jenkins environments. By leveraging this permission, the attacker can invoke the backup operation through the plugin's interface or API, bypassing the intended access controls [1].

Impact

Successful exploitation enables an attacker to initiate a manual backup of Google Cloud resources. This could lead to unauthorized data exposure if backups are stored in accessible locations, or cause resource exhaustion due to repeated backup requests [1].

Mitigation

As of the advisory date (2022-07-27), no fix was available for this vulnerability. The plugin remains affected, and users are advised to restrict Overall/Read permissions or disable the plugin until a patched version is released [2].