Agent-to-controller security bypass in Jenkins HashiCorp Vault Plugin
Date: 2022-02
Affected: maven/com.datapipe.jenkins.plugins:hashicorp-vault-plugin
Attack vector: other
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2022-25186
CVE-2022-25191
CVE-2022-25197
CVE-2022-25204
CVE-2022-25207
CVE-2022-25208
CVE-2022-25209
CWE: CWE-352
CWE-611
CWE-693
CWE-79
CWE-862
CVSS: 3.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N)

Jenkins HashiCorp Vault Plugin 3.8.0 and earlier implements functionality that allows agent processes to retrieve any Vault secrets for use on the agent, allowing attackers able to control agent processes to obtain Vault secrets for an attacker-specified path and key.


Mitigations:

Architectural layers (MAESTRO):