CVE-2022-20621: Jenkins Metrics Information Disclosure

CVE-2022-20621 Overview

CVE-2022-20621 affects Jenkins Metrics Plugin version 4.0.2.8 and earlier. The plugin stores an access key in plaintext within its global configuration file on the Jenkins controller. Any user with read access to the Jenkins controller file system can retrieve this credential. The flaw is categorized under [CWE-522] Insufficiently Protected Credentials.

The vulnerability requires local file system access to exploit, limiting its reach to insiders or attackers who have already gained a foothold. However, recovered access keys can enable lateral movement to integrated metrics and monitoring services.

Critical Impact
An unencrypted access key in the Jenkins controller configuration enables credential theft by any user with file system read access, leading to potential compromise of downstream services.

Affected Products

Jenkins Metrics Plugin 4.0.2.8 and earlier
Jenkins controllers running the vulnerable plugin
Downstream metrics services whose access keys were configured in the plugin

Discovery Timeline

2022-01-12 - Jenkins publishes Security Advisory SECURITY-1624
2022-01-12 - CVE-2022-20621 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-20621

Vulnerability Analysis

The Jenkins Metrics Plugin integrates the Dropwizard Metrics library to expose runtime statistics from Jenkins controllers. When administrators configure the plugin with an access key for an external reporting endpoint, the plugin persists this credential to its global configuration file on disk.

The stored access key is written in cleartext rather than using Jenkins' built-in Secret class, which provides encryption-at-rest using a controller-specific key. As a result, any account that can read the Jenkins JENKINS_HOME directory can recover the plaintext credential.

This weakness is classified as [CWE-522] Insufficiently Protected Credentials. The flaw does not require authentication to Jenkins itself; it requires only operating system level read access on the controller, such as via shell access, backup files, or misconfigured shared storage.

Root Cause

The plugin's configuration persistence logic stores the access key as a plain String field. Jenkins plugins should wrap sensitive values in hudson.util.Secret to invoke automatic encryption when serialized to XML. The Metrics Plugin omitted this wrapper for the access key prior to version 4.0.2.9.

Attack Vector

An attacker with local read access to the Jenkins controller file system locates the plugin's XML configuration file under JENKINS_HOME. Opening the file reveals the access key in plaintext. The recovered key can then be used to authenticate against the external metrics endpoint and read or write telemetry data.

Description only: no public proof-of-concept exploit is available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Jenkins Security Advisory SECURITY-1624 for vendor-provided technical detail.

Detection Methods for CVE-2022-20621

Indicators of Compromise

Presence of plaintext access key strings in Metrics Plugin configuration files under JENKINS_HOME
Unexpected read access to Jenkins controller configuration files by non-administrative users or processes
Anomalous authentications to the external metrics service from hosts other than the Jenkins controller

Detection Strategies

Audit JENKINS_HOME for files belonging to the Metrics Plugin and inspect for unencrypted credential fields
Inventory installed Jenkins plugins and flag any instance of metrics at version 4.0.2.8 or earlier
Correlate file access events on the Jenkins controller with the user accounts authorized to access plugin configuration

Monitoring Recommendations

Enable file integrity monitoring on JENKINS_HOME and alert on reads by unexpected principals
Forward Jenkins controller audit logs and operating system access logs to a centralized analytics platform for review
Monitor the external metrics endpoint for authentication attempts from unfamiliar source addresses

How to Mitigate CVE-2022-20621

Immediate Actions Required

Upgrade the Jenkins Metrics Plugin to version 4.0.2.9 or later
Rotate any access keys that were configured in the plugin while the vulnerable version was installed
Restrict file system permissions on JENKINS_HOME to the Jenkins service account only

Patch Information

Jenkins released a fixed version of the Metrics Plugin alongside Security Advisory SECURITY-1624 on January 12, 2022. The patched plugin stores the access key using the Secret type, which encrypts the value at rest. Administrators should upgrade through the Jenkins Update Center and confirm the installed version is 4.0.2.9 or later. Additional notification was published via the OpenWall OSS Security mailing list.

Workarounds

Remove the access key from the Metrics Plugin configuration if external reporting is not required
Limit shell and backup access to the Jenkins controller to a minimal set of trusted administrators
Store Jenkins backups in encrypted form and restrict access to the backup repository

bash

# Verify the installed Metrics Plugin version on the Jenkins controller
ls $JENKINS_HOME/plugins/metrics/META-INF/MANIFEST.MF \
  && grep -E '^Plugin-Version' $JENKINS_HOME/plugins/metrics/META-INF/MANIFEST.MF

# Tighten permissions on JENKINS_HOME
chown -R jenkins:jenkins $JENKINS_HOME
chmod -R go-rwx $JENKINS_HOME