CVE-2022-28150
📋 TL;DR
This CSRF vulnerability in Jenkins Job and Node ownership Plugin allows attackers to change job owners and permissions without authentication. It affects Jenkins instances with the vulnerable plugin installed, potentially enabling unauthorized access and privilege escalation.
💻 Affected Systems
- Jenkins Job and Node ownership Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could take over jobs, modify permissions to gain administrative control, and disrupt CI/CD pipelines, leading to data theft or system compromise.
Likely Case
Unauthorized users change job ownership to gain access to sensitive build data or execute malicious actions within Jenkins.
If Mitigated
With CSRF protections or network segmentation, impact is limited to minor configuration changes if exploited.
🎯 Exploit Status
Exploitation requires tricking an authenticated user into visiting a malicious site; no public exploit code is known.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.13.1 or later
Vendor Advisory: https://www.jenkins.io/security/advisory/2022-03-29/#SECURITY-2062%20%281%29
Restart Required: Yes
Instructions:
1. Update Jenkins to a supported version. 2. Navigate to Manage Jenkins > Plugin Manager. 3. Update 'Job and Node ownership Plugin' to version 0.13.1 or later. 4. Restart Jenkins to apply changes.
🔧 Temporary Workarounds
Disable the plugin
allTemporarily disable the vulnerable plugin to prevent exploitation.
Navigate to Manage Jenkins > Plugin Manager, find 'Job and Node ownership Plugin', and disable it.
Implement CSRF protections
allEnable Jenkins CSRF protection and use security headers to mitigate attacks.
Set 'hudson.security.csrf.GlobalCrumbIssuerConfiguration' to true in Jenkins configuration.
🧯 If You Can't Patch
- Restrict network access to Jenkins to trusted users only.
- Monitor for unauthorized changes to job ownership and permissions.
🔍 How to Verify
Check if Vulnerable:
Check the plugin version in Jenkins: Go to Manage Jenkins > Plugin Manager, find 'Job and Node ownership Plugin', and verify if version is 0.13.0 or earlier.Check Version:
In Jenkins, use the URL: http://<jenkins-url>/pluginManager/installed to list plugins and versions.Verify Fix Applied:
After updating, confirm the plugin version is 0.13.1 or later in Plugin Manager.📡 Detection & Monitoring
Log Indicators:
- Log entries showing unexpected changes to job ownership or permissions in Jenkins logs.
Network Indicators:
- Unusual HTTP POST requests to Jenkins endpoints related to job configuration from untrusted sources.
SIEM Query:
Example: search for 'jenkins' AND 'job ownership change' in access logs with status 200.