CVE-2022-30964: Cross-site Scripting in Jenkins Multiselect parameter Plugin

Background

Jenkins Multiselect parameter Plugin is a Maven package that provides functionality for creating multiselect parameters in Jenkins views. These parameters allow users to select multiple options from a predefined list. The plugin is commonly used in Jenkins instances to enhance the flexibility of parameterized builds. However, versions 1.3 and earlier of the plugin are vulnerable to a stored cross-site scripting (XSS) attack.

Vulnerability Detail

The vulnerability in Jenkins Multiselect parameter Plugin arises from the lack of proper escaping of the name and description of Multiselect parameters on views displaying parameters. This allows attackers with Item/Configure permission to inject malicious scripts into the affected pages. Exploitation of this vulnerability requires that parameters are listed on other pages, such as the 'Build With Parameters' and 'Parameters' pages provided by Jenkins. If these pages are not hardened to prevent exploitation, an attacker can execute arbitrary scripts in the context of the user's browser, potentially leading to session hijacking, data theft, or other malicious activities. Jenkins (core) has implemented measures to prevent exploitation of similar vulnerabilities on the 'Build With Parameters' and 'Parameters' pages since version 2.44 and LTS 2.32.2, as part of the SECURITY-353 / CVE-2017-2601 fix. However, the Multiselect parameter Plugin version 1.3 and earlier remain vulnerable.

Workaround

If upgrading to the latest version of the Jenkins Multiselect parameter Plugin is not immediately possible, users can apply a workaround to mitigate the risk of exploitation. The workaround involves hardening the 'Build With Parameters' and 'Parameters' pages to prevent XSS attacks. This can be achieved by implementing input validation and proper escaping of parameter names and descriptions. Here is an example of how to harden the pages using the Jenkins Script Console:

1. Access the Jenkins instance.
2. Navigate to 'Manage Jenkins' > 'Script Console'.
3. Enter the following script:

import jenkins.model.Jenkins
import hudson.model.ParameterDefinition

Jenkins.instance.getAllItems(ParameterDefinition).each {
  it.setEscapeDescription(true)
  it.setEscapeName(true)
  it.save()
}

4. Click 'Run' to execute the script.
5. Restart Jenkins for the changes to take effect.

Conclusion

In conclusion, the Jenkins Multiselect parameter Plugin versions 1.3 and earlier are vulnerable to a stored cross-site scripting (XSS) attack. To mitigate this vulnerability, it is recommended to upgrade to version 1.4 or later of the plugin. Alternatively, users can harden the 'Build With Parameters' and 'Parameters' pages to prevent exploitation. For further assistance and support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for io.jenkins.plugins:multiselect-parameter →

FAQ