CVE-2022-41235

Root

Cause

The WildFly Deployer Plugin implements functionality that allows agent processes to read arbitrary files on the Jenkins controller file system [1][2]. This is due to insufficient access control in the plugin's code, which does not properly restrict file read operations initiated from agents.

Exploitation

An attacker with the ability to execute code on a Jenkins agent (e.g., via malicious agent registration or compromised agent) can exploit this vulnerability to read any file on the controller. No authentication on the agent side is required beyond being able to run builds.

Impact

Successful exploitation allows an attacker to read sensitive files, such as credentials stored in Jenkins secrets, configuration files, or arbitrary data, leading to complete compromise of the Jenkins instance.

Mitigation

As of the advisory date, version 1.0.2 and earlier are affected. The plugin has not released a fixed version; users should disable the plugin or restrict agent-to-controller file access using Jenkins security settings until a patch is available [1].