CVE-2022-34187: Cross-site Scripting in Jenkins Filesystem List Parameter Plugin
Summary
CVE-2022-34187: Cross-site Scripting in Jenkins Filesystem List Parameter Plugin. Affects aendter.jenkins.plugins:filesystem-list-parameter-plugin versions < 0.0.7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Filesystem List Parameter Plugin is a Maven package (aendter.jenkins.plugins:filesystem-list-parameter-plugin) that provides functionality for creating file system objects list parameters in Jenkins. These parameters allow users to select files or directories from the file system as input for Jenkins jobs. However, versions 0.0.7 and earlier of the plugin are vulnerable to a stored cross-site scripting (XSS) attack.
Vulnerability Detail
The vulnerability arises from the plugin's failure to properly escape the name and description of file system objects list parameters when displayed on certain pages, such as the 'Build With Parameters' and 'Parameters' pages. This allows an attacker with Item/Configure permission to inject malicious scripts into the parameter names or descriptions, which are then executed when viewed by other users. Exploitation of this vulnerability requires that the parameters are listed on vulnerable pages and that those pages are not protected against XSS attacks. The Jenkins core has addressed similar vulnerabilities in the 'Build With Parameters' and 'Parameters' pages since version 2.44 and LTS 2.32.2 as part of the SECURITY-353 / CVE-2017-2601 fix. Some plugins have also been updated to prevent exploitation by default.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. Users are advised to follow the steps mentioned in the 'how_to_fix' section to mitigate the issue.
Conclusion
The Jenkins Filesystem List Parameter Plugin versions 0.0.7 and earlier are vulnerable to a stored cross-site scripting (XSS) attack. Users should upgrade to a non-affected version of the plugin and ensure their Jenkins installation includes the necessary security fixes. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for aendter.jenkins.plugins:filesystem-list-parameter-plugin →
FAQ
This vulnerability allows an attacker with Item/Configure permission to inject malicious scripts into the parameter names or descriptions of file system objects list parameters. When viewed by other users, these scripts are executed in their browsers, potentially leading to unauthorized actions or data theft.
Versions 0.0.7 and earlier of the Jenkins Filesystem List Parameter Plugin are affected by this vulnerability.
Jenkins (core) has implemented mitigations for similar vulnerabilities on the 'Build With Parameters' and 'Parameters' pages since version 2.44 and LTS 2.32.2. Additionally, several plugins have been updated to prevent exploitation by default.
Yes, the CVSS score for this vulnerability is 8.0, indicating a high severity.
For more information, you can refer to the GitHub Security Advisory GHSA-x95w-qf3m-pqpx or the Jenkins Security Advisory published on June 24, 2022.
Related vulnerabilities
Recent vulnerabilities recorded for aendter.jenkins.plugins:filesystem-list-parameter-plugin.
