CVE-2020-2194: Stored XSS vulnerability in Jenkins ECharts API Plugin
Summary
CVE-2020-2194: Stored XSS vulnerability in Jenkins ECharts API Plugin. Affects io.jenkins.plugins:echarts-api versions < 4.7.0-4. Fixed in 4.7.0-4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Jenkins ECharts API Plugin is a Maven package (io.jenkins.plugins:echarts-api) that provides functionality for generating trend charts in Jenkins. It allows users to visualize build data in a graphical format. The plugin is vulnerable to a stored cross-site scripting (XSS) attack, which can be exploited by users with Run/Update permission.
Vulnerability Detail
The ECharts API Plugin version 4.7.0-3 and earlier does not properly escape the display name of the builds in the trend chart. This allows an attacker to inject malicious scripts into the display name, which will be executed when viewed by other users. The vulnerability can be exploited by users with Run/Update permission, potentially leading to unauthorized access, data theft, or other malicious activities. The issue has been assigned a CVSS score of 5.4, indicating a moderate severity level.
How To Fix
Minimum fixed version
4.7.0-4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to restrict the Run/Update permission for users who should not have access to the plugin. By limiting the permission to trusted individuals, the risk of exploitation can be mitigated. The following code snippet demonstrates how to restrict the permission using the Jenkins Script Console:
import jenkins.model.Jenkins
import hudson.security.Permission
def plugin = Jenkins.instance.pluginManager.getPlugin('echarts-api')
plugin.getWrapper().getPermissions().forEach { perm ->
if (perm.name == 'hudson.model.Item.Build') {
perm.setPermission(Permission.NONE)
}
}
Note that this workaround only limits the permission and does not fix the underlying vulnerability. Upgrading to the patched version is still recommended.
Conclusion
The Jenkins ECharts API Plugin is vulnerable to a stored XSS attack, allowing users with Run/Update permission to execute arbitrary scripts. Upgrading to version 4.7.0-4 or later is recommended to fix the vulnerability. In the meantime, restricting the permission for untrusted users can serve as a temporary workaround. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.jenkins.plugins:echarts-api →
FAQ
The vulnerability allows an attacker to execute arbitrary scripts in the context of other users, potentially leading to unauthorized access, data theft, or other malicious activities.
Users with Run/Update permission in Jenkins can exploit this vulnerability.
Yes, upgrading to ECharts API Plugin version 4.7.0-4 or later fixes this vulnerability.
A temporary workaround is to restrict the Run/Update permission for users who should not have access to the plugin. However, upgrading to the patched version is still recommended.
The CVSS score of this vulnerability is 5.4, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for io.jenkins.plugins:echarts-api.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
