CVE-2022-45391

Vulnerability

Overview

The Jenkins NS-ND Integration Performance Publisher Plugin versions 4.8.0.143 and earlier unconditionally disables SSL/TLS certificate and hostname validation for the entire Jenkins controller JVM [1][2]. This means that any component running in the Jenkins controller, including other plugins, will trust TLS connections without verifying the identity of the remote server [3].

Exploitation

Details

An attacker can exploit this vulnerability by setting up a man-in-the-middle (MITM) position between the Jenkins controller and any external service it connects to over HTTPS [1]. The plugin's global alteration of JVM SSL settings eliminates all certificate validation, allowing intercepting and modifying of TLS communications [4]. No authentication is required on the network, as the attack targets the SSL/TLS trust configuration [3].

Impact

A successful MITM attack can lead to disclosure of sensitive data transmitted over HTTPS, such as credentials or build artifacts, and potentially injection of malicious content into communications [1][2]. The impact is severe because the insecure setting applies globally, affecting all plugins and features of Jenkins using HTTPS connections, not just the NS-ND plugin itself [3].

Mitigation

The vulnerability is fixed in NS-ND Integration Performance Publisher Plugin version 4.8.0.146 [3]. Users should upgrade immediately or remove the plugin if not needed [1][4].