CVE-2022-34186: Cross-site Scripting in Jenkins Dynamic Extended Choice Parameter Plugin

Background

The Jenkins Dynamic Extended Choice Parameter Plugin is a Maven package that provides extended choice parameters for Jenkins views. These parameters allow users to select options from a dropdown menu or a list of checkboxes. The plugin is commonly used to enhance the functionality of Jenkins by providing more flexible and dynamic parameter options for builds. However, versions 1.0.1 and earlier of the plugin are vulnerable to a stored cross-site scripting (XSS) attack.

Vulnerability Detail

The vulnerability in the Jenkins Dynamic Extended Choice Parameter Plugin arises from a failure to properly escape the name and description of Moded Extended Choice parameters on views displaying parameters. This allows an attacker with Item/Configure permission to inject malicious scripts into the parameter fields, which can then be executed by unsuspecting users who interact with the affected pages. Exploitation of this vulnerability requires that parameters are listed on pages like 'Build With Parameters' and 'Parameters' and that these pages are not hardened to prevent XSS attacks. The Jenkins core has implemented measures to prevent similar vulnerabilities on these pages since version 2.44 and LTS 2.32.2. However, the Dynamic Extended Choice Parameter Plugin has not been updated to prevent exploitation by default.

Workaround

If updating the plugin is not immediately feasible, users can implement a workaround by manually escaping the parameter fields in the affected views. This can be done by modifying the Jenkins configuration files or using a script to sanitize the parameter values before displaying them. Here is an example of how to escape the parameter fields using a Groovy script:

import hudson.model.*
import hudson.util.*

def job = Jenkins.instance.getItemByFullName('job_name')
def params = job.getProperty(ParametersDefinitionProperty.class).getParameterDefinition('parameter_name')
params.setDescription(StringEscapeUtils.escapeHtml(params.getDescription()))
params.setChoices(params.getChoices().collect { StringEscapeUtils.escapeHtml(it) })
job.save()

This script retrieves the specified job and parameter, escapes the description and choices, and saves the changes. It is important to replace 'job_name' and 'parameter_name' with the actual names of the job and parameter being modified.

Conclusion

The Jenkins Dynamic Extended Choice Parameter Plugin is vulnerable to a stored cross-site scripting (XSS) attack, allowing attackers to execute arbitrary scripts in the context of unsuspecting users. To mitigate this vulnerability, it is crucial to update the plugin to version 1.0.2 or later. Alternatively, users can implement a workaround by manually escaping the parameter fields in the affected views. For further assistance and support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for com.moded.extendedchoiceparameter:dynamic_extended_choice_parameter →

FAQ