CVE-2022-34178: Reflected Cross-Site Scripting in Jenkins Embeddable Build Status Plugin
Summary
CVE-2022-34178: Reflected Cross site scripting in Jenkins Embeddable Build Status Plugin. Affects org.jenkins-ci.plugins:embeddable-build-status versions < 2.0.4. Fixed in 2.0.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins Embeddable Build Status Plugin is a Maven package that provides functionality for displaying build status badges in Jenkins. These badges can be embedded in external websites or documentation to showcase the status of Jenkins builds. The plugin allows users to specify a 'link' query parameter that the build status badges will link to. However, prior to version 2.0.4, the plugin did not restrict the possible values for this parameter, leading to a reflected cross-site scripting (XSS) vulnerability.
Vulnerability Detail
The vulnerability (CVE-2022-34178) in Jenkins Embeddable Build Status Plugin arises from the lack of proper validation and sanitization of user-supplied input. An attacker can exploit this vulnerability by injecting malicious code into the 'link' query parameter. When a user views a build status badge that includes the crafted link, the injected code will execute in the user's browser, potentially leading to unauthorized actions, data theft, or other malicious activities. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Minimum fixed version
2.0.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to version 2.0.4 is not immediately feasible, a temporary workaround is to manually validate and sanitize the 'link' query parameter before using it to generate build status badges. This can be done by ensuring that the parameter only contains valid URLs with the 'http' or 'https' protocols and by escaping any special characters that could be interpreted as code.
Conclusion
The Jenkins Embeddable Build Status Plugin prior to version 2.0.4 is vulnerable to reflected cross-site scripting (XSS) attacks. Upgrading to version 2.0.4 or later is the recommended solution to mitigate this vulnerability. In the meantime, manual validation and sanitization of the 'link' query parameter can serve as a temporary workaround. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:embeddable-build-status →
FAQ
The vulnerability allows an attacker to execute arbitrary code in the context of a user's browser, potentially leading to unauthorized actions, data theft, or other malicious activities.
No, only versions prior to 2.0.4 are affected. Version 2.0.4 and later include the necessary fixes to mitigate the vulnerability.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is important to promptly apply the recommended fix to prevent potential exploitation.
Yes, this vulnerability can be exploited remotely. An attacker can craft a malicious link and distribute it to unsuspecting users, who may unknowingly execute the injected code in their browsers.
Yes, the CVSS score for this vulnerability is 8.8, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:embeddable-build-status.
