CVE-2022-30967: Cross-Site Scripting in Jenkins Selection tasks Plugin
Summary
CVE-2022-30967: Cross site scripting in Jenkins Selection tasks Plugin. Affects org.jvnet.hudson.plugins:selection-tasks-plugin versions < 1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins Selection tasks Plugin is a Maven package that provides functionality for creating script selection task variable parameters in Jenkins. These parameters are used to configure and customize Jenkins builds. The plugin allows users to define variables with names and descriptions that are displayed on various views. However, versions 1.0 and earlier of the plugin do not properly escape the name and description of these parameters, making them vulnerable to stored cross-site scripting (XSS) attacks. Attackers with Item/Configure permission can exploit this vulnerability to inject malicious scripts into the affected views.
Vulnerability Detail
The vulnerability in Jenkins Selection tasks Plugin arises from the lack of proper escaping of parameter names and descriptions. This allows attackers to inject arbitrary scripts into the affected views, potentially leading to the execution of malicious code in the context of other users. Exploitation of this vulnerability requires that the parameters are listed on vulnerable pages, such as the 'Build With Parameters' and 'Parameters' pages, and that these pages are not hardened against XSS attacks. Jenkins (core) has implemented measures to prevent exploitation of similar vulnerabilities on these pages since version 2.44 and LTS 2.32.2. However, the Selection tasks Plugin has not implemented these protections in versions 1.0 and earlier. The Common Vulnerabilities and Exposures (CVE) identifier for this vulnerability is CVE-2022-30967. The vulnerability has a CVSS score of 8.0, indicating a high severity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the plugin is not immediately feasible, a temporary workaround can be implemented by hardening the vulnerable pages against XSS attacks. This can be achieved by sanitizing user input and properly escaping any dynamic content displayed on these pages. Implementing input validation and output encoding can help mitigate the risk of XSS attacks. However, this workaround should be considered temporary, and updating to a fixed version of the plugin is still recommended.
Conclusion
The Jenkins Selection tasks Plugin version 1.0 and earlier is vulnerable to stored cross-site scripting (XSS) attacks. Attackers with Item/Configure permission can inject malicious scripts into the affected views, potentially leading to the execution of arbitrary code. To mitigate this vulnerability, it is crucial to update the plugin to a fixed version that properly escapes parameter names and descriptions. Additionally, hardening the vulnerable pages against XSS attacks can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jvnet.hudson.plugins:selection-tasks-plugin →
FAQ
This vulnerability allows attackers to inject malicious scripts into the affected views, potentially leading to the execution of arbitrary code in the context of other users. It can be exploited by attackers with Item/Configure permission.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins instance is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file.
Yes, Jenkins (core) has implemented measures to prevent exploitation of vulnerabilities of this kind on the 'Build With Parameters' and 'Parameters' pages since version 2.44 and LTS 2.32.2. However, the Selection tasks Plugin has not implemented these protections in versions 1.0 and earlier.
The CVSS score of this vulnerability is 8.0, indicating a high severity.
A temporary workaround is to harden the vulnerable pages against XSS attacks by implementing input validation and output encoding. However, updating to a fixed version of the plugin is still recommended.
Related vulnerabilities
Recent vulnerabilities recorded for org.jvnet.hudson.plugins:selection-tasks-plugin.
