CVE-2020-2122: Stored XSS vulnerability in Jenkins brakeman Plugin
Summary
CVE-2020-2122: Stored XSS vulnerability in Jenkins brakeman Plugin. Affects org.jenkins-ci.plugins:brakeman versions < 0.13. Fixed in 0.13. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins brakeman Plugin is a Maven package that provides integration with the Brakeman static analysis tool for Ruby on Rails applications. It allows users to perform security scans on their Jenkins builds and generate reports. The plugin parses JSON files and renders the values received from them. However, versions 0.12 and earlier of the plugin did not properly escape these values, leading to a stored cross-site scripting (XSS) vulnerability. This vulnerability can be exploited by users who can control the Brakeman post-build step input data.
Vulnerability Detail
The stored XSS vulnerability in the Jenkins brakeman Plugin arises from the lack of proper value escaping in parsed JSON files. Attackers with control over the Brakeman post-build step input data can inject malicious scripts that will be executed in the context of other users who view the generated reports. This can lead to various consequences, including unauthorized access, data theft, and the potential for further exploitation of the affected system. The vulnerability has a CVSS score of 5.4, indicating a moderate severity level.
How To Fix
Minimum fixed version
0.13
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring that only trusted users have control over the Brakeman post-build step input data. Additionally, it is recommended to regularly update the brakeman Plugin to the latest version to benefit from security fixes.
Conclusion
The Jenkins brakeman Plugin versions 0.12 and earlier are affected by a stored XSS vulnerability that allows attackers to inject malicious scripts into generated reports. Upgrading to version 0.13 or later of the plugin is necessary to fix this vulnerability. Users should also ensure that only trusted individuals have control over the Brakeman post-build step input data and regularly update the plugin to stay protected. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:brakeman →
FAQ
The vulnerability allows attackers to inject malicious scripts into the Jenkins brakeman Plugin's reports. When other users view these reports, the scripts will be executed in their browsers, potentially leading to unauthorized access, data theft, and further exploitation of the affected system.
Users who have control over the Brakeman post-build step input data can exploit this vulnerability by injecting malicious scripts into the parsed JSON files.
Yes, upgrading to version 0.13 or later of the brakeman Plugin fixes this vulnerability by properly escaping affected values from parsed files.
While there is no specific workaround mentioned, users can mitigate the risk by ensuring that only trusted users have control over the Brakeman post-build step input data and regularly updating the brakeman Plugin to the latest version.
Yes, historical data recorded before upgrading to the fixed version of the brakeman Plugin may still contain unsafe values. It is recommended to review and sanitize historical data if necessary.
