CVE-2020-2256: Stored XSS vulnerability in Pipeline Maven Integration Plugin via unescaped display name
Summary
CVE-2020-2256: Stored XSS vulnerability in Pipeline Maven Integration Plugin via unescaped display name. Affects org.jenkins-ci.plugins:pipeline-maven versions < 3.9.3. Fixed in 3.9.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Pipeline Maven Integration Plugin is a plugin for Jenkins, an open-source automation server. It provides integration between Jenkins pipelines and Maven projects, allowing users to build, test, and deploy Maven-based projects. The plugin allows users to define pipelines that automate the build and deployment process for Maven projects within Jenkins. This vulnerability affects versions 3.9.2 and earlier of the Pipeline Maven Integration Plugin.
Vulnerability Detail
The vulnerability in the Pipeline Maven Integration Plugin arises from a failure to properly escape the display name of an upstream job shown as part of a build cause. This allows an attacker with Job/Configure permission to inject malicious code into the display name, resulting in a stored cross-site scripting (XSS) vulnerability. When the vulnerable plugin is used in conjunction with Jenkins, an attacker could exploit this vulnerability to execute arbitrary JavaScript code in the context of a user's browser. This could lead to various security risks, such as stealing sensitive information or performing actions on behalf of the user.
How To Fix
Minimum fixed version
3.9.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of the Pipeline Maven Integration Plugin is not immediately feasible, users can implement a workaround by manually escaping the display name of upstream jobs in build causes. This can be done by modifying the Jenkins pipeline script to sanitize the display name before it is used in the build cause. Here is an example of how to escape the display name using Groovy script:
import hudson.model.Cause
def upstreamJobName = 'Upstream Job'
def escapedUpstreamJobName = Cause.escape(upstreamJobName)
Conclusion
The Pipeline Maven Integration Plugin versions 3.9.2 and earlier are vulnerable to a stored XSS vulnerability. This vulnerability can be mitigated by upgrading to version 3.9.3 or later of the plugin. If immediate upgrade is not possible, users can implement a workaround by manually escaping the display name of upstream jobs in build causes. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:pipeline-maven →
FAQ
This vulnerability allows an attacker with Job/Configure permission to execute arbitrary JavaScript code in the context of a user's browser. This could lead to various security risks, such as stealing sensitive information or performing actions on behalf of the user.
Users of Jenkins who have the Pipeline Maven Integration Plugin installed and are using versions 3.9.2 or earlier are affected by this vulnerability.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert analyzes the pom.xml file of your application to identify and alert you about open-source vulnerabilities in real-time.
Yes, a fix is available in version 3.9.3 of the Pipeline Maven Integration Plugin. It is recommended to upgrade to this version or later to mitigate the vulnerability.
If upgrading to the latest version of the Pipeline Maven Integration Plugin is not immediately feasible, you can manually escape the display name of upstream jobs in build causes using Groovy script. Refer to the 'workaround' section for more details.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:pipeline-maven.
