CVE-2022-30960: Cross-site Scripting in Jenkins Application Detector Plugin
Summary
CVE-2022-30960: Cross-site Scripting in Jenkins Application Detector Plugin. Affects org.jenkins-ci.plugins:app-detector versions < 1.0.9. Fixed in 1.0.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Application Detector Plugin is a Maven-based package that provides functionality for detecting and managing applications within the Jenkins environment. It allows users to define and configure application versions for different projects. The plugin is vulnerable to a stored cross-site scripting (XSS) attack, which can be exploited by attackers with Item/Configure permission.
Vulnerability Detail
The vulnerability in the Jenkins Application Detector Plugin (version 1.0.8 and earlier) arises from the lack of proper escaping of the Chois Application Version parameters when displayed on views that show parameters. This allows an attacker to inject malicious scripts into the application, which can be executed when viewed by other users with sufficient permissions. The impact of this vulnerability can range from unauthorized data access to complete control over the affected Jenkins instance.
How To Fix
Minimum fixed version
1.0.9
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the affected views displaying parameters to only trusted users with appropriate permissions. This can be achieved by modifying the Jenkins configuration to limit access to the vulnerable views or by using Jenkins plugins that provide access control features. However, applying the workaround is not a permanent solution, and it is strongly advised to upgrade to the fixed version of the plugin as soon as possible.
Conclusion
The Jenkins Application Detector Plugin is susceptible to a stored cross-site scripting vulnerability that can be exploited by attackers with Item/Configure permission. Upgrading to version 1.0.9 or later of the plugin is the recommended solution. Restricting access to the vulnerable views can serve as a temporary workaround. For further assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:app-detector →
FAQ
The vulnerability allows an attacker to execute arbitrary scripts in the context of the affected Jenkins instance, potentially leading to unauthorized data access, privilege escalation, or complete compromise of the system.
Attackers with Item/Configure permission in the Jenkins environment can exploit this vulnerability by injecting malicious scripts into the Chois Application Version parameters.
At the time of this report, there is no known public exploit for this vulnerability. However, it is advisable to apply the recommended fixes to prevent any potential exploitation.
Applying the recommended fix by upgrading to the latest version of the Jenkins Application Detector Plugin is the most effective mitigation for this vulnerability. Additionally, restricting access to the vulnerable views can provide temporary protection.
There is no evidence of active exploitation of this vulnerability at the time of this report. However, it is crucial to apply the necessary fixes to prevent any potential attacks.
