CVE-2022-27198
📋 TL;DR
A CSRF vulnerability in Jenkins CloudBees AWS Credentials Plugin allows attackers with Overall/Read permission to trick authenticated users into connecting Jenkins to attacker-controlled AWS services using malicious tokens. This affects Jenkins instances with the vulnerable plugin installed where users have read access.
💻 Affected Systems
- Jenkins CloudBees AWS Credentials Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could connect Jenkins to malicious AWS services, potentially leading to credential theft, data exfiltration, or using Jenkins as a pivot point to attack AWS infrastructure.
Likely Case
Attackers could abuse Jenkins' AWS integration to access sensitive AWS resources or use Jenkins to perform unauthorized AWS operations.
If Mitigated
With proper CSRF protections and limited user permissions, impact would be minimal to none.
🎯 Exploit Status
Exploitation requires social engineering to trick authenticated users into visiting malicious pages.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 190.vde70164c05d6 and later
Vendor Advisory: https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2351
Restart Required: Yes
Instructions:
1. Update Jenkins CloudBees AWS Credentials Plugin to version 190.vde70164c05d6 or later via Jenkins Plugin Manager. 2. Restart Jenkins instance.
🔧 Temporary Workarounds
Implement CSRF Protection
allEnable and configure Jenkins CSRF protection to prevent cross-site request forgery attacks.
Restrict User Permissions
allLimit Overall/Read permissions to only trusted administrators.
🧯 If You Can't Patch
- Disable the CloudBees AWS Credentials Plugin if not required
- Implement network segmentation to isolate Jenkins from production AWS environments
🔍 How to Verify
Check if Vulnerable:
Check Jenkins plugin manager for CloudBees AWS Credentials Plugin version. If version is 189.v3551d5642995 or earlier, system is vulnerable.Check Version:
Check via Jenkins web interface: Manage Jenkins > Plugin Manager > Installed pluginsVerify Fix Applied:
Verify plugin version is 190.vde70164c05d6 or later in Jenkins plugin manager.📡 Detection & Monitoring
Log Indicators:
- Unexpected AWS credential configuration changes
- AWS API calls from Jenkins with unfamiliar tokens
Network Indicators:
- Jenkins making outbound connections to unfamiliar AWS endpoints
SIEM Query:
source="jenkins.log" AND ("AWS Credentials" OR "cloudbees-aws-credentials") AND ("configure" OR "update")