CVE-2022-23116
📋 TL;DR
This vulnerability in Jenkins Conjur Secrets Plugin allows attackers who control Jenkins agent processes to decrypt secrets stored in Jenkins that were obtained through other means. It affects Jenkins instances using Conjur Secrets Plugin version 1.0.9 or earlier. Attackers need existing access to agent processes to exploit this flaw.
💻 Affected Systems
- Jenkins Conjur Secrets Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers with agent control could decrypt all Jenkins secrets, potentially compromising credentials, API keys, and sensitive configuration data stored in Jenkins.
Likely Case
Malicious or compromised agents could access secrets they shouldn't have permission to view, leading to lateral movement or data exfiltration.
If Mitigated
With proper agent security controls and network segmentation, impact is limited to secrets accessible to already-compromised agents.
🎯 Exploit Status
Requires existing access to Jenkins agent processes. Not directly exploitable from network.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.10 or later
Vendor Advisory: https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2522%20%281%29
Restart Required: Yes
Instructions:
1. Update Jenkins Conjur Secrets Plugin to version 1.0.10 or later via Jenkins Plugin Manager. 2. Restart Jenkins after plugin update. 3. Verify plugin version in Manage Jenkins > Manage Plugins.
🔧 Temporary Workarounds
Restrict Agent Access
allLimit which agents can access sensitive secrets by configuring agent permissions and job restrictions.
Network Segmentation
allIsolate Jenkins agents from sensitive systems and implement strict network controls.
🧯 If You Can't Patch
- Implement strict agent security controls and monitor agent activity
- Rotate all secrets stored in Jenkins and implement secret management best practices
🔍 How to Verify
Check if Vulnerable:
Check Jenkins plugin manager for Conjur Secrets Plugin version. If version is 1.0.9 or earlier, system is vulnerable.Check Version:
Check via Jenkins web UI: Manage Jenkins > Manage Plugins > Installed tab, or check JENKINS_HOME/plugins/conjur-credentials.jpi/META-INF/MANIFEST.MFVerify Fix Applied:
Verify Conjur Secrets Plugin version is 1.0.10 or later in Jenkins plugin manager.📡 Detection & Monitoring
Log Indicators:
- Unusual secret access patterns from agents
- Agent processes accessing decryption functions unexpectedly
Network Indicators:
- Agents making unexpected connections to secret storage systems
SIEM Query:
source="jenkins.log" AND ("conjur" OR "secret" OR "decrypt") AND agent_process="*"