File Manipulation Vulnerability in Jenkins Pipeline Input Step Plugin

CVE-2022-34177

Summary

The Jenkins Pipeline Input Step Plugin suffers from a security issue that allows for improper file handling. Specifically, it archives uploaded files associated with file parameters for Pipeline input steps within the controller. This occurs without appropriate sanitization, which means attackers can exploit this feature to craft Pipelines that may create or overwrite files in the Jenkins controller file system with their own content. Consequently, this vulnerability poses a serious risk for unauthorized file manipulation, potentially compromising the integrity and security of build processes.

References