CVE-2022-25200
📋 TL;DR
This CSRF vulnerability in Jenkins Checkmarx Plugin allows attackers to trick authenticated users into connecting to malicious servers using stolen credential IDs, potentially exposing sensitive Jenkins credentials. It affects Jenkins installations using Checkmarx Plugin version 2022.1.2 or earlier. Attackers need to obtain credential IDs through other means first.
💻 Affected Systems
- Jenkins Checkmarx Plugin
📦 What is this software?
Checkmarx by Jenkins
⚠️ Risk & Real-World Impact
Worst Case
Attackers capture all Jenkins credentials, gaining full administrative access to Jenkins and potentially compromising connected systems.
Likely Case
Attackers capture specific credentials used by the Checkmarx plugin, potentially accessing source code repositories or build systems.
If Mitigated
With proper CSRF protections and credential management, impact is limited to failed connection attempts.
🎯 Exploit Status
Requires attacker to obtain credential IDs through other means first, then craft CSRF attack.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2022.1.3 or later
Vendor Advisory: https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-1017
Restart Required: Yes
Instructions:
1. Update Jenkins Checkmarx Plugin to version 2022.1.3 or later via Jenkins Plugin Manager. 2. Restart Jenkins service. 3. Verify plugin version in Jenkins interface.
🔧 Temporary Workarounds
Disable Checkmarx Plugin
allTemporarily disable the vulnerable plugin until patching is possible
java -jar jenkins-cli.jar -s http://jenkins-server:8080/ disable-plugin checkmarx
Enable CSRF Protection
allEnsure Jenkins CSRF protection is enabled globally
🧯 If You Can't Patch
- Restrict network access to Jenkins instance
- Implement strict credential rotation and monitoring
🔍 How to Verify
Check if Vulnerable:
Check Jenkins plugin manager for Checkmarx Plugin version. If version is 2022.1.2 or earlier, system is vulnerable.Check Version:
curl -s http://jenkins-server:8080/pluginManager/api/json?depth=1 | grep -o '"checkmarx[^}]*' | grep -o '"version":"[^"]*'Verify Fix Applied:
Verify Checkmarx Plugin version is 2022.1.3 or later in Jenkins plugin manager.📡 Detection & Monitoring
Log Indicators:
- Unexpected Checkmarx server connection attempts
- Failed authentication attempts from unusual IPs
Network Indicators:
- Outbound connections from Jenkins to unknown servers on Checkmarx plugin ports
SIEM Query:
source="jenkins.log" AND "Checkmarx" AND ("connection failed" OR "authentication error")