CVE-2020-2226: Stored XSS vulnerability in Jenkins Matrix Authorization Strategy Plugin
Summary
CVE-2020-2226: Stored XSS vulnerability in Jenkins Matrix Authorization Strategy Plugin. Affects org.jenkins-ci.plugins:matrix-auth versions < 2.6.2. Fixed in 2.6.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Matrix Authorization Strategy Plugin is a plugin for the Jenkins automation server that provides a matrix-based security strategy for controlling access to Jenkins resources. It allows administrators to define permissions for individual users or groups on a per-project basis. The plugin is widely used in Jenkins installations to manage access control and authorization.
Vulnerability Detail
The Matrix Authorization Strategy Plugin version 2.6.1 and earlier is vulnerable to a stored cross-site scripting (XSS) attack. The plugin fails to properly escape user names displayed in the permission table, allowing an attacker to inject malicious scripts. This vulnerability can be exploited by users with Job/Configure or Agent/Configure permission in project-based matrix authorization, or by users with Overall/Administer permission. An attacker could use this vulnerability to execute arbitrary JavaScript code in the context of other users, potentially leading to unauthorized actions, data theft, or further compromise of the Jenkins server.
How To Fix
Minimum fixed version
2.6.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, a temporary workaround is to restrict the permissions of users who have access to Job/Configure, Agent/Configure, or Overall/Administer. By limiting these permissions to trusted users only, the risk of exploitation can be reduced.
Conclusion
The Matrix Authorization Strategy Plugin version 2.6.1 and earlier is vulnerable to a stored XSS attack. It is recommended to upgrade to version 2.6.2 or later to mitigate this vulnerability. Restricting the permissions of users with Job/Configure, Agent/Configure, or Overall/Administer access can also reduce the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:matrix-auth →
FAQ
This vulnerability allows an attacker to execute arbitrary JavaScript code in the context of other users, potentially leading to unauthorized actions, data theft, or further compromise of the Jenkins server.
Users of Matrix Authorization Strategy Plugin versions 2.6.1 and earlier are affected by this vulnerability.
There are currently no known public exploits specifically targeting this vulnerability.
No, this vulnerability requires the attacker to have Job/Configure, Agent/Configure, or Overall/Administer permissions in order to exploit it.
Yes, upgrading to Matrix Authorization Strategy Plugin version 2.6.2 or later fixes this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:matrix-auth.
