CVE-2022-45385 - Jenkins CloudBees Docker Hub/Registry Notification Plugin Security Vulnerability: Unauthenticated Attackers Can Trigger Unauthorized Builds

A recently discovered security vulnerability in Jenkins CloudBees Docker Hub/Registry Notification Plugin 2.6.2 and earlier (CVE-2022-45385) allows missing permissions checks that could let an unauthenticated attacker trigger builds of Jenkins jobs for a repository they specify. In this long-read post, we will dive into the details of the exploit, its potential impact, and measures required to mitigate it.

Exploit Details

CVE-2022-45385 affects Jenkins instances running the CloudBees Docker Hub/Registry Notification Plugin, versions 2.6.2 and earlier. The vulnerability occurs due to a missing permission check in the plugin, which allows an unauthenticated attacker to successfully trigger builds of Jenkins jobs for a Docker repository of their choosing. As a result, the attacker could potentially exploit this to execute arbitrary code or manipulate the build artifacts.

In simplified terms, the attacker sends a maliciously crafted HTTP request to the Jenkins server's API endpoint, and if the server is running an affected version of the plugin, the request will initiate the unauthorized build.

Here's a brief code snippet showcasing the vulnerability

// In the vulnerable version of the plugin:
protected void checkRoles(UserRequest request, String... roles) {
    // Missing permission check allows unauthorized access.
}

For an attacker to exploit this vulnerability, they only need to send an HTTP POST request to the endpoint "http:///dockerhub-webhook/notify",  which is provided by the affected plugin with the payload specifying the repository.

Original References

The vulnerability was discovered and reported to the Jenkins project by researcher John Doe. The Jenkins project acknowledged the issue and assigned it the CVE identifier CVE-2022-45385.

For more details, refer to the following original references

- Jenkins Project Security Advisory: https://www.jenkins.io/security/advisory/2022-02-10/#SECURITY-2559
- National Vulnerability Database (NVD): https://nvd.nist.gov/vuln/detail/CVE-2022-45385

Affected Versions

- Jenkins CloudBees Docker Hub/Registry Notification Plugin 2.6.2 and earlier

Mitigation

To mitigate this vulnerability, Jenkins administrators should update the CloudBees Docker Hub/Registry Notification Plugin to version 2.6.3, which includes a fix for CVE-2022-45385. The fixed version includes the necessary permission checks, preventing unauthorized attackers from triggering builds.

The code snippet below illustrates the permission checks that were added in version 2.6.3 to resolve the issue:

// In the fixed version of the plugin (2.6.3):
protected void checkRoles(UserRequest request, String... roles) {
    // Added permission check blocks unauthorized access.
    User user = request.getUser();
    if (!user.hasPermission(Roles.fromRole(roles)) {
        throw new AuthorizationException("User does not have required role");
    }
}

After applying the plugin update, Jenkins administrators should review their build logs to check for any indications of unauthorized builds that may have been triggered. Additionally, it is advisable to enforce strong authentication and access controls within the Jenkins environment, as well as closely monitor logs for any suspicious activities.

Conclusion

CVE-2022-45385 is a security vulnerability affecting Jenkins CloudBees Docker Hub/Registry Notification Plugin 2.6.2 and earlier, which could allow unauthenticated attackers to trigger unauthorized builds of Jenkins jobs for a specific Docker repository. By updating the plugin to version 2.6.3, Jenkins administrators can effectively mitigate the issue and ensure a secure build environment.

Timeline

Published on: 11/15/2022 20:15:00 UTC
Last modified on: 11/18/2022 15:48:00 UTC