CVE-2020-2113: Jenkins Git Parameter Plugin stored cross-site scripting (XSS)
Summary
CVE-2020-2113: Jenkins Git Parameter Plugin vulnerable to stored cross-site scripting (XSS). Affects org.jenkins-ci.tools:git-parameter versions < 0.9.12. Fixed in 0.9.12. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Git Parameter Plugin is a Maven package (org.jenkins-ci.tools:git-parameter) that provides functionality for integrating Git repositories with Jenkins. It allows users to define Git parameters for Jenkins jobs, enabling dynamic configuration and customization. However, versions 0.9.11 and earlier of the plugin are vulnerable to stored cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability in Jenkins Git Parameter Plugin arises from the lack of proper escaping of the default value displayed on the user interface. This allows users with Job/Configure permission to inject malicious scripts, leading to stored cross-site scripting attacks. An attacker could exploit this vulnerability to execute arbitrary code within the context of the affected user's browser, potentially compromising sensitive information or performing unauthorized actions.
How To Fix
Minimum fixed version
0.9.12
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually escape the default value by ensuring that any user-provided input is properly sanitized and encoded before being displayed on the UI. This can be achieved by using appropriate encoding functions or libraries, such as OWASP Java Encoder, to mitigate the risk of XSS attacks. Here is an example of how to sanitize user input in Java:
import org.owasp.encoder.Encode;
String sanitizedValue = Encode.forHtml(defaultValue);
Note that this workaround should only be considered as a temporary measure until the plugin is updated to a secure version.
Conclusion
The Jenkins Git Parameter Plugin versions 0.9.11 and earlier are vulnerable to stored cross-site scripting (XSS) attacks. It is essential for users to upgrade to version 0.9.12 or later to address this vulnerability. In the meantime, users can apply the temporary workaround of properly sanitizing and encoding user input. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.tools:git-parameter →
FAQ
The vulnerability allows an attacker with Job/Configure permission to execute arbitrary code within the affected user's browser. This can lead to the compromise of sensitive information, unauthorized actions, or further exploitation of the system.
Users of Jenkins Git Parameter Plugin versions 0.9.11 and earlier are affected by this vulnerability. Specifically, users with Job/Configure permission are at risk.
The recommended mitigation is to upgrade to version 0.9.12 or later of the Jenkins Git Parameter Plugin. Additionally, users can apply the temporary workaround of properly sanitizing and encoding user input before displaying it on the UI.
Yes, this vulnerability has been assigned the CVE identifier CVE-2020-2113.
There is no specific evidence of active exploits targeting this vulnerability at the moment. However, it is crucial to apply the recommended fixes and security updates to mitigate the risk of potential attacks.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.tools:git-parameter.
