CVE-2022-43418

Vulnerability

Overview

CVE-2022-43418 is a cross-site request forgery (CSRF) vulnerability in the Jenkins Katalon Plugin, versions 1.0.33 and earlier. The plugin fails to require CSRF protection on a form validation endpoint, allowing an attacker to craft a malicious request that, when triggered by an authenticated Jenkins user, connects to an attacker-specified URL using attacker-specified credential IDs [1][3]. This enables the capture of credentials stored in Jenkins.

Exploitation

Prerequisites

Exploitation requires an authenticated Jenkins user who has access to the Katalon Plugin configuration. The attacker must first obtain valid credential IDs through another method, such as a separate vulnerability or information disclosure. The attacker then tricks the user into clicking a crafted link or visiting a malicious page, which triggers the CSRF request. The request uses the provided credential IDs to connect to an attacker-controlled server, effectively exfiltrating the credentials [1][3].

Impact

Successful exploitation leads to the disclosure of Jenkins credentials, including API tokens, passwords, and other secrets stored in the Jenkins credential store. This can compromise not only Jenkins itself but also any external systems integrated with Jenkins that rely on those credentials [1][3].

Mitigation

The vulnerability is fixed in Katalon Plugin version 1.0.34 [2]. Users are strongly advised to upgrade to this version or later. The plugin is available through the Jenkins update center [4]. No workarounds have been documented.