CVE-2022-36882
📋 TL;DR
This CSRF vulnerability in Jenkins Git Plugin allows attackers to trigger unauthorized builds of jobs configured with Git repositories. Attackers can force Jenkins to check out arbitrary commits from attacker-controlled repositories, potentially leading to code execution or supply chain attacks. Affects Jenkins instances with Git Plugin 4.11.3 or earlier installed.
💻 Affected Systems
- Jenkins Git Plugin
📦 What is this software?
Git by Jenkins
⚠️ Risk & Real-World Impact
Worst Case
Attackers execute arbitrary code on Jenkins servers by triggering builds with malicious commits, potentially compromising the entire CI/CD pipeline and downstream systems.
Likely Case
Attackers inject malicious code into builds, leading to supply chain attacks, data exfiltration, or disruption of development workflows.
If Mitigated
With proper CSRF protections and access controls, impact is limited to unauthorized build triggers without code execution.
🎯 Exploit Status
Exploitation requires tricking authenticated users into visiting malicious pages. CSRF tokens are not properly validated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Git Plugin 4.11.4
Vendor Advisory: https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284
Restart Required: Yes
Instructions:
1. Update Jenkins Git Plugin to version 4.11.4 or later via Jenkins Plugin Manager. 2. Restart Jenkins to apply changes. 3. Verify plugin version in Manage Jenkins > Plugin Manager.
🔧 Temporary Workarounds
Enable CSRF Protection
allEnsure Jenkins CSRF protection is enabled globally
Check: Manage Jenkins > Configure Global Security > Enable CSRF Protection
Restrict Build Permissions
allLimit who can trigger builds on vulnerable jobs
Configure job permissions: Job Configuration > Build Triggers > Restrict where this project can be run
🧯 If You Can't Patch
- Implement network segmentation to isolate Jenkins from production systems
- Enable audit logging for all build triggers and monitor for unauthorized activity
🔍 How to Verify
Check if Vulnerable:
Check Git Plugin version in Jenkins: Manage Jenkins > Plugin Manager > Installed plugins, look for Git Plugin version 4.11.3 or earlier.Check Version:
java -jar jenkins-cli.jar -s http://jenkins-url/ list-plugins | grep gitVerify Fix Applied:
Verify Git Plugin version is 4.11.4 or later in Plugin Manager. Test CSRF protection by attempting to trigger builds without valid tokens.📡 Detection & Monitoring
Log Indicators:
- Unauthorized build triggers from unexpected IPs
- Git repository URLs changed unexpectedly in build logs
- Failed CSRF token validation attempts
Network Indicators:
- HTTP POST requests to /job/*/build without CSRF tokens
- Unusual Git clone operations from external repositories
SIEM Query:
source="jenkins.log" AND ("CSRF token" AND "invalid") OR ("build triggered" AND NOT user=*)