CVE-2020-2224: Stored XSS vulnerability in Jenkins Matrix Project Plugin
Summary
CVE-2020-2224: Stored XSS vulnerability in single axis builds tooltips in Jenkins Matrix Project Plugin. Affects org.jenkins-ci.plugins:matrix-project versions < 1.17. Fixed in 1.17. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Matrix Project Plugin is a Maven package that provides functionality for creating and managing matrix projects in Jenkins. Matrix projects allow users to define multiple configurations of a project by specifying different combinations of axes. This plugin is widely used in Jenkins installations for managing complex build configurations. However, versions 1.16 and earlier of the plugin are vulnerable to a stored cross-site scripting (XSS) attack.
Vulnerability Detail
The vulnerability in the Matrix Project Plugin arises from the lack of proper escaping of node names shown in tooltips on the overview page of builds with a single axis. This allows an attacker with Agent/Configure permission to inject malicious scripts into the tooltips, which will be executed when viewed by other users. The impact of this vulnerability is significant as it can lead to unauthorized access, data theft, and the execution of arbitrary code on the affected Jenkins instance.
How To Fix
Minimum fixed version
1.17
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of the Matrix Project Plugin is not immediately feasible, a temporary workaround is to restrict the Agent/Configure permission to trusted users only. By limiting the access to this permission, the risk of exploitation can be mitigated. However, this workaround is not a permanent solution and upgrading to the fixed version is strongly recommended.
Conclusion
The stored XSS vulnerability in Jenkins Matrix Project Plugin (CVE-2020-2224) poses a significant risk to Jenkins installations using versions 1.16 and earlier of the plugin. Upgrading to version 1.17 or later is strongly recommended to mitigate the vulnerability. Restricting the Agent/Configure permission to trusted users can serve as a temporary workaround until the upgrade is performed. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:matrix-project →
FAQ
The vulnerability allows an attacker to execute arbitrary code on the affected Jenkins instance, potentially leading to unauthorized access, data theft, and system compromise.
Users of Matrix Project Plugin versions 1.16 and earlier are affected by this vulnerability.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins instance is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for any known vulnerabilities, including this one.
At the time of this advisory, there are no known public exploits for this vulnerability. However, it is important to patch your system as soon as possible to prevent any potential exploitation.
Yes, this vulnerability is identified as CVE-2020-2224.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:matrix-project.
