CVE-2022-28154
📋 TL;DR
This vulnerability in Jenkins Coverage/Complexity Scatter Plot Plugin allows attackers to perform XML External Entity (XXE) attacks by exploiting improper XML parser configuration. Attackers can read arbitrary files from the Jenkins controller file system, potentially exposing sensitive data. All Jenkins instances using affected plugin versions are vulnerable.
💻 Affected Systems
- Jenkins Coverage/Complexity Scatter Plot Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of Jenkins controller with arbitrary file read, potentially exposing credentials, configuration files, and sensitive data stored on the server.
Likely Case
Unauthorized reading of sensitive files from Jenkins controller, potentially exposing credentials, SSH keys, or configuration data.
If Mitigated
Limited impact with proper network segmentation and file system permissions restricting access to sensitive files.
🎯 Exploit Status
Exploitation requires Jenkins user with Overall/Read permission. XXE attacks are well-documented and relatively easy to execute.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1.2
Vendor Advisory: https://www.jenkins.io/security/advisory/2022-03-29/#SECURITY-1899
Restart Required: Yes
Instructions:
1. Update Jenkins Coverage/Complexity Scatter Plot Plugin to version 1.1.2 or later via Jenkins Plugin Manager. 2. Restart Jenkins to apply the update. 3. Verify plugin version in Jenkins plugin management interface.
🔧 Temporary Workarounds
Disable vulnerable plugin
allTemporarily disable the Coverage/Complexity Scatter Plot Plugin until patching is possible
Navigate to Jenkins > Manage Jenkins > Manage Plugins > Installed tab > Find plugin > Click 'Disable'
Restrict user permissions
allLimit Overall/Read permissions to trusted users only to reduce attack surface
Navigate to Jenkins > Manage Jenkins > Manage and Assign Roles > Configure permissions to restrict Overall/Read
🧯 If You Can't Patch
- Disable the Coverage/Complexity Scatter Plot Plugin completely
- Implement strict network segmentation and firewall rules to limit access to Jenkins instances
🔍 How to Verify
Check if Vulnerable:
Check plugin version in Jenkins: Manage Jenkins > Manage Plugins > Installed tab > Search for 'Coverage/Complexity Scatter Plot Plugin'Check Version:
Check Jenkins plugin directory or use Jenkins CLI: java -jar jenkins-cli.jar -s http://jenkins-url/ list-plugins | grep 'Coverage/Complexity Scatter Plot Plugin'Verify Fix Applied:
Verify plugin version is 1.1.2 or later in Jenkins plugin management interface📡 Detection & Monitoring
Log Indicators:
- Unusual XML parsing errors in Jenkins logs
- Multiple failed authentication attempts followed by XML processing requests
- File read operations from unexpected locations
Network Indicators:
- HTTP POST requests with XML payloads containing external entity declarations
- Outbound connections from Jenkins to unexpected external servers
SIEM Query:
source="jenkins.log" AND ("XXE" OR "external entity" OR "DOCTYPE" OR "SYSTEM")