CVE-2022-30969
📋 TL;DR
A CSRF vulnerability in Jenkins Autocomplete Parameter Plugin allows attackers to trick authenticated administrators into executing arbitrary code without sandbox restrictions. This affects Jenkins instances with the vulnerable plugin installed where administrators access malicious web content. Attackers can achieve remote code execution with administrator privileges.
💻 Affected Systems
- Jenkins Autocomplete Parameter Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise through remote code execution with administrator privileges, allowing installation of backdoors, data theft, and lateral movement.
Likely Case
Attacker gains persistent access to Jenkins server, can modify builds, steal credentials, and access connected systems.
If Mitigated
No impact if proper CSRF protections are enabled and administrators avoid untrusted web content.
🎯 Exploit Status
Exploitation requires social engineering to trick administrators but technical complexity is low once the victim visits malicious content.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2
Vendor Advisory: https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2322
Restart Required: Yes
Instructions:
1. Update Jenkins Autocomplete Parameter Plugin to version 1.2 or later via Jenkins Plugin Manager. 2. Restart Jenkins service. 3. Verify plugin version in Installed Plugins list.
🔧 Temporary Workarounds
Enable CSRF Protection
allEnsure Jenkins CSRF protection is enabled in global security settings
Navigate to Manage Jenkins > Configure Global Security > Enable 'Prevent Cross Site Request Forgery exploits'
Remove Vulnerable Plugin
allUninstall the Autocomplete Parameter Plugin if not required
Navigate to Manage Jenkins > Plugin Manager > Installed > Uncheck Autocomplete Parameter Plugin > Apply
🧯 If You Can't Patch
- Restrict administrator access to trusted networks only
- Implement web application firewall rules to block suspicious CSRF patterns
🔍 How to Verify
Check if Vulnerable:
Check installed plugin version via Manage Jenkins > Plugin Manager > Installed plugins > Autocomplete ParameterCheck Version:
curl -s http://jenkins-host/pluginManager/installed | grep -A5 'Autocomplete Parameter'Verify Fix Applied:
Verify plugin version is 1.2 or higher in Installed Plugins list📡 Detection & Monitoring
Log Indicators:
- Unusual plugin configuration changes
- Unexpected Groovy script execution
- Administrative actions from unexpected IPs
Network Indicators:
- HTTP POST requests to /descriptorByName/... endpoints with suspicious parameters
- Outbound connections to unknown destinations after plugin actions
SIEM Query:
source="jenkins.log" AND ("Autocomplete Parameter" OR "descriptorByName") AND (POST OR configChange)