CVE-2022-36920
📋 TL;DR
This CSRF vulnerability in Jenkins Coverity Plugin allows attackers to trick authenticated users into connecting Jenkins to attacker-controlled URLs using stolen credential IDs. This could expose sensitive credentials stored in Jenkins. Affects Jenkins instances with Coverity Plugin 1.11.4 or earlier installed.
💻 Affected Systems
- Jenkins Coverity Plugin
📦 What is this software?
Coverity by Jenkins
⚠️ Risk & Real-World Impact
Worst Case
Attackers capture all credentials stored in Jenkins, potentially gaining access to internal systems, source code repositories, deployment pipelines, and sensitive infrastructure.
Likely Case
Attackers capture some credentials, leading to unauthorized access to connected systems like version control, artifact repositories, or deployment targets.
If Mitigated
With proper CSRF protections and credential access controls, impact is limited to potential connection failures or minor configuration changes.
🎯 Exploit Status
Requires attacker to obtain credential IDs through other means and trick authenticated user into visiting malicious page.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.11.5 or later
Vendor Advisory: https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2790%20%282%29
Restart Required: Yes
Instructions:
1. Update Jenkins Coverity Plugin to version 1.11.5 or later via Jenkins Plugin Manager. 2. Restart Jenkins instance. 3. Verify plugin version in Manage Jenkins > Manage Plugins.
🔧 Temporary Workarounds
Enable CSRF Protection
allEnsure Jenkins CSRF protection is enabled globally
Check 'Prevent Cross Site Request Forgery exploits' is enabled in Manage Jenkins > Configure Global Security
Restrict Plugin Access
allLimit who can configure Coverity Plugin
Use Jenkins Role-Based Strategy plugin to restrict 'Configure' permission for Coverity Plugin
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Jenkins from sensitive systems
- Rotate all credentials stored in Jenkins and implement credential access monitoring
🔍 How to Verify
Check if Vulnerable:
Check plugin version in Jenkins: Manage Jenkins > Manage Plugins > Installed tab, search for 'Coverity'Check Version:
On Jenkins server: java -jar jenkins-cli.jar -s http://localhost:8080/ list-plugins | grep -i coverityVerify Fix Applied:
Verify Coverity Plugin version is 1.11.5 or higher in Manage Plugins📡 Detection & Monitoring
Log Indicators:
- Unexpected Coverity plugin configuration changes in Jenkins logs
- Failed authentication attempts to new Coverity server URLs
Network Indicators:
- Jenkins server connecting to unfamiliar external URLs on Coverity plugin ports
- Unusual outbound traffic patterns from Jenkins
SIEM Query:
source="jenkins.log" AND ("Coverity" AND "configuration" AND "changed")