CVE-2022-27204
📋 TL;DR
A cross-site request forgery (CSRF) vulnerability in Jenkins Extended Choice Parameter Plugin allows attackers to trick authenticated users into making unintended requests to attacker-controlled URLs. This affects Jenkins installations using the vulnerable plugin version, potentially leading to unauthorized actions being performed with the victim's privileges.
💻 Affected Systems
- Jenkins Extended Choice Parameter Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could execute arbitrary Jenkins operations with the victim's permissions, potentially leading to remote code execution, data exfiltration, or complete system compromise.
Likely Case
Attackers could manipulate Jenkins jobs, steal credentials, or perform unauthorized administrative actions by tricking authenticated users.
If Mitigated
With proper CSRF protections and network segmentation, impact is limited to the specific Jenkins instance and plugin functionality.
🎯 Exploit Status
Exploitation requires tricking an authenticated user into visiting a malicious page while logged into Jenkins.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 347.vd8b_35a_040b_42 or later
Vendor Advisory: https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-1350
Restart Required: Yes
Instructions:
1. Update Jenkins Extended Choice Parameter Plugin to version 347.vd8b_35a_040b_42 or later via Jenkins Plugin Manager. 2. Restart Jenkins to apply the update.
🔧 Temporary Workarounds
Disable vulnerable plugin
allTemporarily disable the Extended Choice Parameter Plugin if immediate patching is not possible.
Navigate to Jenkins > Manage Jenkins > Manage Plugins > Installed tab > Find 'Extended Choice Parameter' > Click 'Disable'
🧯 If You Can't Patch
- Implement strict network access controls to limit Jenkins access to trusted users only
- Enable CSRF protection in Jenkins global security settings and use anti-CSRF tokens
🔍 How to Verify
Check if Vulnerable:
Check Jenkins plugin manager for Extended Choice Parameter Plugin version. If version is 346.vd87693c5a_86c or earlier, system is vulnerable.Check Version:
Check via Jenkins web UI: Manage Jenkins > Manage Plugins > Installed tab > Find 'Extended Choice Parameter'Verify Fix Applied:
Verify plugin version is 347.vd8b_35a_040b_42 or later in Jenkins Plugin Manager.📡 Detection & Monitoring
Log Indicators:
- Unusual plugin-related errors in Jenkins logs
- Unexpected requests to external URLs from Jenkins
Network Indicators:
- Outbound connections from Jenkins to unexpected external domains
- CSRF token validation failures
SIEM Query:
source="jenkins.log" AND ("Extended Choice Parameter" OR "CSRF" OR "forgery")