CVE-2022-28142
📋 TL;DR
The Jenkins Proxmox Plugin versions 0.6.0 and earlier disable SSL/TLS certificate validation globally for the entire Jenkins controller JVM when configured to ignore SSL/TLS issues. This allows man-in-the-middle attackers to intercept and manipulate communications between Jenkins and Proxmox servers. Organizations using vulnerable plugin versions with SSL/TLS validation disabled are affected.
💻 Affected Systems
- Jenkins Proxmox Plugin
📦 What is this software?
Proxmox by Jenkins
⚠️ Risk & Real-World Impact
Worst Case
Attackers could intercept sensitive credentials, inject malicious code into Jenkins jobs, or compromise the entire Jenkins infrastructure through man-in-the-middle attacks.
Likely Case
Credential theft and unauthorized access to Proxmox infrastructure, potentially leading to VM compromise and lateral movement within the environment.
If Mitigated
Limited to denial of service or failed communications between Jenkins and Proxmox if proper network segmentation and certificate validation are enforced.
🎯 Exploit Status
Exploitation requires man-in-the-middle position and the plugin to be configured with SSL/TLS validation disabled. No authentication bypass needed if attacker can intercept traffic.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.7.0 or later
Vendor Advisory: https://www.jenkins.io/security/advisory/2022-03-29/#SECURITY-2081
Restart Required: Yes
Instructions:
1. Update Jenkins Proxmox Plugin to version 0.7.0 or later via Jenkins Plugin Manager. 2. Restart Jenkins instance. 3. Verify SSL/TLS certificate validation is properly configured and not globally disabled.
🔧 Temporary Workarounds
Disable SSL/TLS bypass configuration
allRemove or disable the 'Ignore SSL/TLS certificate validation' option in Proxmox plugin configuration
Navigate to Jenkins > Manage Jenkins > Configure System > Proxmox section > Uncheck 'Ignore SSL/TLS certificate validation'
Network segmentation and monitoring
allIsolate Jenkins-Proxmox communications and monitor for unexpected certificate validation failures
🧯 If You Can't Patch
- Disable the 'Ignore SSL/TLS certificate validation' option in plugin configuration immediately
- Implement strict network segmentation between Jenkins and Proxmox servers, monitor all communications
🔍 How to Verify
Check if Vulnerable:
Check Jenkins plugin manager for Proxmox Plugin version. If version is 0.6.0 or earlier AND 'Ignore SSL/TLS certificate validation' is enabled in plugin configuration, the system is vulnerable.Check Version:
Jenkins URL: /pluginManager/installed (look for Proxmox Plugin) or check Jenkins logs during startupVerify Fix Applied:
Verify Proxmox Plugin version is 0.7.0 or later and SSL/TLS certificate validation is properly configured and working.📡 Detection & Monitoring
Log Indicators:
- SSL/TLS certificate validation errors in Jenkins logs
- Unexpected successful connections despite invalid certificates
- Plugin configuration changes enabling SSL bypass
Network Indicators:
- Unencrypted or improperly validated SSL/TLS traffic between Jenkins and Proxmox servers
- Man-in-the-middle attack patterns in network traffic
SIEM Query:
source="jenkins.log" AND ("SSL" OR "TLS" OR "certificate" OR "validation") AND ("error" OR "bypass" OR "ignore")