CVE-2022-34183: Cross-site Scripting in Jenkins Agent Server Parameter Plugin
Summary
CVE-2022-34183: Cross-site Scripting in Jenkins Agent Server Parameter Plugin. Affects io.jenkins.plugins:agent-server-parameter versions < 1.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Agent Server Parameter Plugin is a Maven package (io.jenkins.plugins:agent-server-parameter) that provides functionality for defining and managing Agent Server parameters in Jenkins. These parameters allow users to configure various settings for the agent server. However, versions 1.1 and earlier of the plugin are vulnerable to a stored cross-site scripting (XSS) attack. This vulnerability arises from the lack of proper escaping of the name and description of Agent Server parameters on views displaying parameters. Attackers with Item/Configure permission can exploit this vulnerability.
Vulnerability Detail
The stored XSS vulnerability in the Jenkins Agent Server Parameter Plugin allows attackers with Item/Configure permission to inject malicious scripts into the name and description fields of Agent Server parameters. When these parameters are listed on certain pages, such as the 'Build With Parameters' and 'Parameters' pages, the injected scripts are executed in the context of the victim's browser. This can lead to various consequences, including unauthorized access to sensitive information, session hijacking, and arbitrary code execution. The vulnerability can be exploited if the affected pages are not hardened to prevent XSS attacks. Jenkins (core) has addressed similar vulnerabilities in the 'Build With Parameters' and 'Parameters' pages since version 2.44 and LTS 2.32.2.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the display of Agent Server parameters on vulnerable pages. This can be achieved by modifying the Jenkins configuration or adjusting the permissions of affected users. However, this workaround may limit the functionality of the plugin and is not a permanent solution. It is strongly advised to apply the recommended fix by upgrading to the latest version of the plugin.
Conclusion
The Jenkins Agent Server Parameter Plugin is vulnerable to a stored XSS attack, allowing attackers with Item/Configure permission to execute arbitrary scripts in the context of the victim's browser. To mitigate this vulnerability, users should upgrade to version 1.2 or later of the plugin. It is also recommended to harden the 'Build With Parameters' and 'Parameters' pages in Jenkins (core) to prevent similar exploits. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.jenkins.plugins:agent-server-parameter →
FAQ
The vulnerability allows attackers to execute arbitrary scripts in the context of the victim's browser. This can lead to unauthorized access to sensitive information, session hijacking, and arbitrary code execution.
Attackers with Item/Configure permission in Jenkins can exploit this vulnerability.
Upgrading the Jenkins Agent Server Parameter Plugin to version 1.2 or later mitigates this vulnerability. Additionally, hardening the 'Build With Parameters' and 'Parameters' pages in Jenkins (core) can prevent exploitation.
Jenkins (core) has addressed similar vulnerabilities in the 'Build With Parameters' and 'Parameters' pages since version 2.44 and LTS 2.32.2.
Yes, the CVSS score for this vulnerability is 8.0 (High).
Related vulnerabilities
Recent vulnerabilities recorded for io.jenkins.plugins:agent-server-parameter.
