CVE-2022-30968: Cross-site Scripting in Jenkins vboxwrapper Plugin
Summary
CVE-2022-30968: Cross-site Scripting in Jenkins vboxwrapper Plugin. Affects org.jenkins-ci.plugins:vboxwrapper versions < 1.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins vboxwrapper Plugin is a Maven package that provides functionality for managing VirtualBox nodes in Jenkins. It allows users to configure and control VirtualBox instances as build agents in Jenkins. The plugin integrates with Jenkins views and parameters, allowing users to specify VBox node parameters for their builds. However, versions 1.3 and earlier of the plugin are vulnerable to a stored cross-site scripting (XSS) attack.
Vulnerability Detail
The vulnerability in the Jenkins vboxwrapper Plugin arises from a failure to properly escape the name and description of VBox node parameters when displaying them on views that show parameters. This allows an attacker with Item/Configure permission to inject malicious scripts into the name or description fields, which will be executed when the parameters are displayed. The vulnerability can be exploited if the parameters are listed on pages like 'Build With Parameters' and 'Parameters' and those pages are not hardened against XSS attacks. The Jenkins core has addressed similar vulnerabilities in the past, but the vboxwrapper Plugin remains vulnerable in versions 1.3 and earlier.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can remove the vulnerable plugin from their Jenkins installation or disable the use of VBox node parameters in their builds. This will eliminate the risk of XSS attacks through the vboxwrapper Plugin. However, this may impact the functionality of builds that rely on VBox nodes.
Conclusion
The Jenkins vboxwrapper Plugin versions 1.3 and earlier are vulnerable to a stored cross-site scripting (XSS) attack. This can be exploited by an attacker with Item/Configure permission to inject malicious scripts into the name or description fields of VBox node parameters. To mitigate this vulnerability, users should update the plugin to version 1.4 or later and ensure their Jenkins installation is up to date with the latest security fixes. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:vboxwrapper →
FAQ
The vulnerability allows an attacker with Item/Configure permission to inject malicious scripts into the name or description fields of VBox node parameters. When these parameters are displayed on certain pages, the scripts will be executed in the context of the user viewing the page. This can lead to various attacks, such as stealing sensitive information or performing actions on behalf of the user.
No, this vulnerability requires an attacker to have Item/Configure permission in Jenkins. It cannot be exploited remotely without authenticated access to the Jenkins instance.
Yes, Jenkins core has addressed similar vulnerabilities in the past and has hardened the 'Build With Parameters' and 'Parameters' pages against XSS attacks since version 2.44 and LTS 2.32.2. However, the vboxwrapper Plugin remains vulnerable in versions 1.3 and earlier.
Updating the vboxwrapper Plugin to version 1.4 or later is the recommended mitigation. Users should also ensure that their Jenkins installation is up to date with the latest security fixes.
Yes, the CVSS score for this vulnerability is 8.0, indicating a high severity.
