CVE-2022-29043: Stored Cross-site Scripting in Jenkins Mask Passwords Plugin
Summary
CVE-2022-29043: Stored Cross-site Scripting in Jenkins Mask Passwords Plugin. Affects org.jenkins-ci.plugins:mask-passwords versions < 3.1. Fixed in 3.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Mask Passwords Plugin is a Maven package (org.jenkins-ci.plugins:mask-passwords) that provides functionality for masking passwords in Jenkins. It is commonly used to secure sensitive information such as passwords and API keys in Jenkins configurations. However, versions 3.0 and earlier of the plugin are vulnerable to a stored cross-site scripting (XSS) attack.
Vulnerability Detail
The vulnerability in the Jenkins Mask Passwords Plugin allows attackers with Item/Configure permission to exploit a stored XSS vulnerability. The plugin fails to properly escape the name and description of Non-Stored Password parameters on views displaying parameters. This allows an attacker to inject malicious scripts into the parameter fields, which are then executed when the parameters are displayed on other pages, such as the 'Build With Parameters' and 'Parameters' pages in Jenkins. Exploitation of this vulnerability requires that the pages displaying the parameters are not hardened to prevent XSS attacks. The Jenkins core has addressed similar vulnerabilities in the 'Build With Parameters' and 'Parameters' pages since version 2.44 and LTS 2.32.2 as part of the SECURITY-353 / CVE-2017-2601 fix.
How To Fix
Minimum fixed version
3.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to version 3.1 or later is not immediately possible, a temporary workaround is to harden the 'Build With Parameters' and 'Parameters' pages in Jenkins to prevent XSS attacks. This can be done by implementing input validation and output encoding to sanitize user input and prevent the execution of malicious scripts. Here is an example of how to implement input validation in a Jenkins pipeline script:
stage('Build With Parameters') {
steps {
script {
def userInput = input(
id: 'userInput',
message: 'Enter parameters',
parameters: [
string(name: 'param1', description: 'Parameter 1', defaultValue: '', trim: true, regex: '^[a-zA-Z0-9]*$', error: 'Invalid input')
]
)
// Use the sanitized userInput
}
}
}
This workaround should be considered temporary, and it is strongly recommended to upgrade to the latest version of the plugin as soon as possible.
Conclusion
The Jenkins Mask Passwords Plugin is vulnerable to a stored cross-site scripting (XSS) attack, which can be exploited by attackers with Item/Configure permission. To mitigate this vulnerability, it is recommended to upgrade to version 3.1 or later of the plugin. If immediate upgrade is not possible, hardening the 'Build With Parameters' and 'Parameters' pages in Jenkins can serve as a temporary workaround. It is important to promptly address this vulnerability to prevent potential security risks and protect the Jenkins environment. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:mask-passwords →
FAQ
The vulnerability allows an attacker with Item/Configure permission to inject and execute malicious scripts in the parameter fields of the Jenkins Mask Passwords Plugin. This can lead to various security risks, including unauthorized access to sensitive information, privilege escalation, and potential compromise of the Jenkins environment.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file as input.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is important to promptly address and fix the vulnerability to prevent potential exploitation.
Yes, the CVSS score for this vulnerability is 8.0, indicating a high severity level. It is crucial to take immediate action to mitigate the risk and protect the Jenkins environment.
You can refer to the Jenkins Security Advisory https://www.jenkins.io/security/advisory/2017-02-01/#persisted-cross-site-scripting-vulnerability-in-parameter-names-and-descriptions for more information about the fix implemented in Jenkins core to prevent similar vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:mask-passwords.
