CVE-2022-34177
📋 TL;DR
This vulnerability in Jenkins Pipeline: Input Step Plugin allows attackers with Pipeline configuration permissions to write arbitrary files on the Jenkins controller file system. Attackers can use unsanitized parameter names as relative paths to create or replace files with malicious content. This affects Jenkins instances using the vulnerable plugin version.
💻 Affected Systems
- Jenkins Pipeline: Input Step Plugin
📦 What is this software?
Pipeline\ by Jenkins
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of Jenkins controller via arbitrary file write leading to remote code execution, data theft, or system takeover.
Likely Case
Unauthorized file creation/modification leading to privilege escalation, data manipulation, or persistence mechanisms.
If Mitigated
Limited impact with proper access controls and monitoring; file writes contained to non-critical directories.
🎯 Exploit Status
Exploitation requires authenticated access with Pipeline configuration permissions; path traversal via unsanitized parameter names.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 448.v37cea_9a_10a_71 and later
Vendor Advisory: https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2705
Restart Required: Yes
Instructions:
1. Update Jenkins Pipeline: Input Step Plugin to version 448.v37cea_9a_10a_71 or later via Jenkins Plugin Manager. 2. Restart Jenkins to apply the update.
🔧 Temporary Workarounds
Restrict Pipeline Configuration Permissions
allLimit who can configure Pipelines to trusted users only using Jenkins Role-Based Access Control.
Disable File Parameter Input Steps
allAvoid using file parameters in Pipeline input steps until patched.
🧯 If You Can't Patch
- Implement strict access controls to limit Pipeline configuration to essential personnel only.
- Monitor file system changes on Jenkins controller for unauthorized writes to build-related directories.
🔍 How to Verify
Check if Vulnerable:
Check Jenkins Plugin Manager for Pipeline: Input Step Plugin version; if version is 448.v37cea_9a_10a_70 or earlier, it's vulnerable.Check Version:
Navigate to Jenkins > Manage Jenkins > Plugin Manager > Installed tab and search for 'Pipeline: Input Step'.Verify Fix Applied:
Verify plugin version is 448.v37cea_9a_10a_71 or later in Jenkins Plugin Manager after update.📡 Detection & Monitoring
Log Indicators:
- Unusual file write operations in Jenkins logs to build directories
- Suspicious parameter names in Pipeline input step logs
Network Indicators:
- Unusual HTTP requests to Jenkins API configuring Pipelines with file parameters
SIEM Query:
source="jenkins.log" AND ("file parameter" OR "input step") AND ("write" OR "archive")