CVE-2022-27200: Stored Cross-site Scripting vulnerability in Jenkins Folder-based Authorization Strategy Plugin
Summary
CVE-2022-27200: Stored Cross-site Scripting vulnerability in Jenkins Folder-based Authorization Strategy Plugin. Affects io.jenkins.plugins:folder-auth versions < 1.4. Fixed in 1.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Jenkins Folder-based Authorization Strategy Plugin is a plugin for the Jenkins automation server that provides folder-based authorization for managing user access control. It allows administrators to define roles and permissions at the folder level, enabling fine-grained access control within Jenkins. This plugin is commonly used in Jenkins installations to enforce security policies and restrict user actions based on their assigned roles.
Vulnerability Detail
The Jenkins Folder-based Authorization Strategy Plugin version 1.3 and earlier is vulnerable to a stored cross-site scripting (XSS) attack. This vulnerability arises from a lack of proper input sanitization when displaying role names on the configuration form. Attackers with Overall/Administer permission can exploit this vulnerability by injecting malicious scripts into the role names, which will then be executed when displayed on the configuration form. This can lead to unauthorized access, data theft, or further exploitation of the affected Jenkins instance.
How To Fix
Minimum fixed version
1.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually escape the role names by HTML-encoding special characters. This can be done by modifying the role names in the Jenkins configuration file or through the Jenkins user interface. Here is an example of how to HTML-encode the role names using Java code:
import org.apache.commons.text.StringEscapeUtils;
String roleName = "<script>alert('XSS')</script>";
String escapedRoleName = StringEscapeUtils.escapeHtml4(roleName);
Conclusion
The Jenkins Folder-based Authorization Strategy Plugin version 1.3 and earlier is vulnerable to a stored cross-site scripting (XSS) attack. Users should upgrade to version 1.4 or later to fix this vulnerability. In the meantime, users can apply a temporary workaround by HTML-encoding the role names. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.jenkins.plugins:folder-auth →
FAQ
This vulnerability allows attackers with Overall/Administer permission to execute arbitrary scripts within the context of the affected Jenkins instance. This can lead to unauthorized access, data theft, or further exploitation of the system.
No, only versions 1.3 and earlier are affected. Users of version 1.4 and later are not vulnerable to this specific issue.
At the time of this advisory, there are no known public exploits targeting this vulnerability. However, it is important to apply the recommended fix to prevent potential exploitation.
No, this vulnerability requires an attacker to have Overall/Administer permission within the Jenkins instance. Remote exploitation is not possible unless the attacker already has administrative access.
There is no evidence of active attacks exploiting this vulnerability at the time of this advisory. However, it is recommended to apply the fix as soon as possible to mitigate any potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for io.jenkins.plugins:folder-auth.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
