CVE-2018-1000604: Jenkins Badge Plugin cross-site scripting vulnerability
Summary
CVE-2018-1000604: Jenkins Badge Plugin cross-site scripting vulnerability. Affects org.jenkins-ci.plugins:badge versions < 1.5. Fixed in 1.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Jenkins Badge Plugin is a plugin for the Jenkins automation server that allows users to add badges to their build jobs. These badges provide visual indicators of the build status or other custom metrics. The plugin integrates with the Jenkins web UI to display the badges. However, versions 1.4 and earlier of the plugin are vulnerable to a persisted cross-site scripting (XSS) attack. This means that an attacker who can control the content of a build badge can inject malicious JavaScript code that will be executed in another user's browser when they perform certain actions in the Jenkins UI.
Vulnerability Detail
The vulnerability exists in the BadgeSummaryAction.java and HtmlBadgeAction.java files of the Jenkins Badge Plugin. It allows an attacker to define JavaScript code in the build badge content, which will be executed in another user's browser. This can lead to various attacks, such as stealing sensitive information, performing actions on behalf of the user, or modifying the Jenkins UI. The vulnerability has a CVSS score of 5.4, indicating a moderate severity level. The CWE ID associated with this vulnerability is CWE-79, which refers to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
How To Fix
Minimum fixed version
1.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to a newer version of the Jenkins Badge Plugin is not immediately possible, a temporary workaround is to disable the use of custom HTML content in build badges. This can be done by configuring the plugin to only use predefined badge templates or text-based badges. By avoiding the use of HTML content, the risk of XSS attacks is mitigated.
Conclusion
The Jenkins Badge Plugin versions 1.4 and earlier are vulnerable to a persisted cross-site scripting (XSS) attack. To mitigate this vulnerability, it is recommended to upgrade to version 1.5 or newer of the plugin. If immediate upgrade is not possible, disabling the use of custom HTML content in build badges can provide temporary protection. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:badge →
FAQ
The vulnerability allows an attacker to execute arbitrary JavaScript code in another user's browser, potentially leading to unauthorized actions, data theft, or UI manipulation.
Users of Jenkins Badge Plugin versions 1.4 and earlier are affected by this vulnerability. Users of newer versions (1.5 and above) are not vulnerable.
There are no known public exploits for this vulnerability at the time of this report. However, it is recommended to patch the vulnerability as soon as possible to prevent any potential attacks.
The recommended mitigation is to upgrade to version 1.5 or newer of the Jenkins Badge Plugin. If immediate upgrade is not possible, disabling the use of custom HTML content in build badges can reduce the risk of exploitation.
Yes, the CVSS score for this vulnerability is 5.4, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:badge.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
