CVE-2020-2173: XSS vulnerability in Jenkins Gatling Plugin
Summary
CVE-2020-2173: XSS vulnerability in Jenkins Gatling Plugin. Affects org.jenkins-ci.plugins:gatling versions < 1.3.0. Fixed in 1.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Gatling Plugin is a Maven package that provides functionality for serving Gatling reports in Jenkins. It allows users to view and analyze performance test reports generated by the Gatling tool. The plugin integrates with Jenkins and provides a user-friendly interface for accessing and managing Gatling reports within the Jenkins environment.
Vulnerability Detail
The Gatling Plugin version 1.2.7 and earlier has a cross-site scripting (XSS) vulnerability. This vulnerability arises due to the plugin serving Gatling reports in a manner that bypasses the Content-Security-Policy protection introduced in Jenkins 1.641 and 1.625.3. As a result, users who can modify the report content can exploit this vulnerability. The XSS vulnerability allows an attacker to inject malicious scripts into the report, which can be executed by other users viewing the report. This can lead to various security risks, including unauthorized access, data theft, and privilege escalation.
How To Fix
Minimum fixed version
1.3.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can manually modify the Content-Security-Policy configuration in Jenkins to provide additional protection against XSS attacks. This can be achieved by adding appropriate directives to the Content-Security-Policy header. However, it is strongly recommended to upgrade to the fixed version of the Gatling Plugin as the workaround may not provide complete protection against all possible XSS vectors. Here is an example of how to modify the Content-Security-Policy header in Jenkins:
# Modify the Content-Security-Policy header in Jenkins
1. Go to Jenkins Dashboard
2. Navigate to Manage Jenkins > Configure System
3. Scroll down to the 'Content-Security-Policy' section
4. Add the following directive to the 'Content-Security-Policy' header:
script-src 'self';
5. Save the configuration
Conclusion
In conclusion, the Jenkins Gatling Plugin versions 1.2.7 and earlier are vulnerable to a cross-site scripting (XSS) attack. This vulnerability can be exploited by users who can modify the content of Gatling reports. To mitigate this vulnerability, it is recommended to upgrade to the fixed version 1.3.0 or later. Additionally, users can apply a workaround by modifying the Content-Security-Policy configuration in Jenkins. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:gatling →
FAQ
The XSS vulnerability in the Gatling Plugin allows an attacker to inject malicious scripts into the Gatling reports. When other users view these reports, the injected scripts can be executed in their browsers, leading to potential security risks such as unauthorized access, data theft, and privilege escalation.
Users of Jenkins with the Gatling Plugin versions 1.2.7 and earlier are affected by this vulnerability. Specifically, users who have the ability to modify the content of Gatling reports are at risk of exploiting this XSS vulnerability.
The recommended mitigation for this vulnerability is to upgrade the Gatling Plugin to version 1.3.0 or later. This version addresses the XSS vulnerability by changing the way Gatling reports are served in Jenkins. Additionally, users can manually modify the Content-Security-Policy configuration in Jenkins to provide additional protection against XSS attacks.
Yes, a workaround is available for this vulnerability. Users can manually modify the Content-Security-Policy configuration in Jenkins to add appropriate directives that enhance protection against XSS attacks. However, it is strongly recommended to upgrade to the fixed version of the Gatling Plugin as the workaround may not provide complete protection against all possible XSS vectors.
For more information about this vulnerability, you can refer to the GitHub Security Advisory GHSA-hv53-qjg6-5pm9. The advisory provides detailed information about the vulnerability, affected versions, and the recommended fix.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:gatling.
