CVE-2022-41232

Vulnerability

Overview

A cross-site request forgery (CSRF) vulnerability in Jenkins Build-Publisher Plugin 1.22 and earlier allows an attacker to replace any config.xml file on the Jenkins controller file system with an empty file. This is achieved by providing a crafted file name to an API endpoint [1][2]. The root cause is the lack of CSRF protection on the affected endpoint, which allows an unauthenticated attacker to trick a logged-in administrator into submitting a malicious request.

Exploitation and

Attack Surface

To exploit this vulnerability, an attacker must convince a Jenkins administrator with appropriate permissions to click a crafted link or visit a malicious page while the administrator is authenticated to the Jenkins instance. There is no authentication required for the attacker, but the victim must have access to the Jenkins interface. The attack can be performed remotely over the network, and no special privileges are needed for the attacker [1].

Impact

Successful exploitation enables the attacker to delete or corrupt XML configuration files (e.g., config.xml) for any Jenkins item, job, or the system itself, effectively destroying configuration data. This denial-of-service or data loss could disrupt Jenkins operations and require administrative recovery [1][2].

Mitigation and

Status

The Jenkins project has suspended distribution of the Build-Publisher Plugin due to its incompatibility with security features introduced in Jenkins 2.222+ (CSRF protection) and 2.266+ (JEP-200) [3]. Users are strongly advised to remove or disable the plugin and migrate to alternative solutions. No patched version is available, so the best mitigation is to stop using the plugin [1][3].