CVE-2022-43417

Vulnerability

Overview

CVE-2022-43417 affects the Jenkins Katalon Plugin versions 1.0.32 and earlier. The plugin fails to perform permission checks in several HTTP endpoints, enabling an attacker with only Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method [1][3]. This allows the attacker to capture credentials stored in Jenkins.

Exploitation

Prerequisites

To exploit this vulnerability, an attacker must have Overall/Read permission on the Jenkins instance, which is a low-privilege access level. Additionally, the attacker must obtain valid credentials IDs through a separate vulnerability or information disclosure [1][2]. Once these prerequisites are met, the attacker can craft requests to the vulnerable endpoints, causing the plugin to send stored credentials to an external URL under the attacker's control.

Impact

Successful exploitation results in the exfiltration of Jenkins credentials, which may include passwords, API tokens, or other secrets. These credentials can then be used to gain further unauthorized access to Jenkins or connected systems, potentially leading to a broader compromise of the CI/CD pipeline [1][3].

Mitigation

The vulnerability has been fixed in Katalon Plugin versions 1.0.33 and 1.0.34 [2]. Users are strongly advised to upgrade to one of these versions immediately. No workaround is documented; upgrading is the only recommended mitigation.