CVE-2022-30958
📋 TL;DR
This CSRF vulnerability in Jenkins SSH Plugin allows attackers to trick authenticated users into unknowingly connecting to attacker-controlled SSH servers using stolen Jenkins credentials. Attackers can capture sensitive credentials stored in Jenkins. All Jenkins instances using SSH Plugin 2.6.1 or earlier are affected.
💻 Affected Systems
- Jenkins SSH Plugin
📦 What is this software?
Ssh by Jenkins
⚠️ Risk & Real-World Impact
Worst Case
Complete credential theft from Jenkins, leading to lateral movement, data exfiltration, and potential compromise of connected systems.
Likely Case
Attackers steal SSH credentials stored in Jenkins, enabling unauthorized access to systems using those credentials.
If Mitigated
Limited impact with proper CSRF protections, credential rotation, and network segmentation in place.
🎯 Exploit Status
Exploitation requires tricking authenticated user to visit malicious page. Credential IDs must be obtained separately.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: SSH Plugin 2.6.2
Vendor Advisory: https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2093
Restart Required: Yes
Instructions:
1. Update Jenkins SSH Plugin to version 2.6.2 or later via Jenkins Plugin Manager. 2. Restart Jenkins after update.
🔧 Temporary Workarounds
Enable CSRF Protection
allEnsure Jenkins CSRF protection is enabled globally
Check Jenkins Configure Global Security settings for CSRF protection
Restrict Network Access
allLimit outbound SSH connections from Jenkins to trusted networks only
Configure firewall rules to restrict Jenkins SSH outbound traffic
🧯 If You Can't Patch
- Rotate all SSH credentials stored in Jenkins immediately
- Implement strict network segmentation to limit Jenkins SSH outbound connections
🔍 How to Verify
Check if Vulnerable:
Check SSH Plugin version in Jenkins Plugin Manager. If version is 2.6.1 or earlier, system is vulnerable.Check Version:
Check Jenkins web interface: Manage Jenkins > Manage Plugins > Installed tab, search for SSH PluginVerify Fix Applied:
Verify SSH Plugin version is 2.6.2 or later in Jenkins Plugin Manager.📡 Detection & Monitoring
Log Indicators:
- Unexpected SSH connection attempts from Jenkins to unknown IPs
- Failed SSH authentication attempts using Jenkins credentials
Network Indicators:
- Outbound SSH connections from Jenkins to suspicious external IPs
- SSH traffic patterns inconsistent with normal operations
SIEM Query:
source="jenkins.log" AND ("SSH connection" OR "credentials") AND ("failed" OR "unauthorized")