CVE-2022-34190: Cross-site Scripting in Jenkins Maven Metadata Plugin
Summary
CVE-2022-34190: Cross-site Scripting in Jenkins Maven Metadata Plugin. Affects eu.markov.jenkins.plugin.mvnmeta:maven-metadata-plugin versions < 2.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Maven Metadata Plugin is a plugin for the Jenkins CI server that provides functionality for managing Maven metadata. It allows users to view and manipulate metadata associated with Maven artifacts. The plugin is commonly used in Jenkins environments that utilize Maven for build and dependency management. However, versions 2.1 and earlier of the plugin are vulnerable to a stored cross-site scripting (XSS) attack.
Vulnerability Detail
The vulnerability in the Jenkins Maven Metadata Plugin arises from a failure to properly escape the name and description of List Maven artifact versions parameters on views displaying parameters. This allows an attacker with Item/Configure permission to inject malicious scripts into the affected pages, leading to potential XSS attacks. Exploitation of this vulnerability requires that parameters are listed on pages like 'Build With Parameters' and 'Parameters' and that those pages are not hardened to prevent exploitation. The Jenkins core has implemented measures to prevent exploitation of similar vulnerabilities on these pages since version 2.44 and LTS 2.32.2. However, the Jenkins Maven Metadata Plugin has not been updated to prevent exploitation by default.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can manually escape the name and description of List Maven artifact versions parameters when configuring their Jenkins jobs. This can be done by encoding any user-supplied input and ensuring that it is properly escaped before being displayed on the affected pages. Here is an example of how to encode user input in Java:
import org.apache.commons.text.StringEscapeUtils;
String userInput = ...; // User-supplied input
String escapedInput = StringEscapeUtils.escapeHtml4(userInput);
By applying this encoding to user input, the risk of XSS attacks can be mitigated.
Conclusion
The Jenkins Maven Metadata Plugin is vulnerable to a stored cross-site scripting (XSS) attack, which can be exploited by an attacker with Item/Configure permission. To mitigate this vulnerability, it is crucial to update the plugin to version 2.2 or later. Additionally, users can apply a workaround by manually escaping user input. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for eu.markov.jenkins.plugin.mvnmeta:maven-metadata-plugin →
FAQ
The vulnerability allows an attacker with Item/Configure permission to inject malicious scripts into the affected pages, potentially leading to the execution of arbitrary code in the context of other users accessing those pages. This can result in unauthorized access to sensitive information, session hijacking, or other malicious activities.
While there are no known public exploits for this specific vulnerability at the time of this report, it is important to promptly apply the recommended fixes to mitigate the risk of exploitation.
No, this vulnerability requires an attacker to have Item/Configure permission in the Jenkins environment. Remote exploitation is not possible unless an attacker gains unauthorized access to the Jenkins server with the necessary permissions.
The Jenkins core has implemented measures to prevent exploitation of similar vulnerabilities on the 'Build With Parameters' and 'Parameters' pages since version 2.44 and LTS 2.32.2. However, the Jenkins Maven Metadata Plugin has not been updated to prevent exploitation by default. It is recommended to update the plugin to the latest version available.
Yes, a workaround is to manually escape the name and description of List Maven artifact versions parameters when configuring Jenkins jobs. This can be done by encoding user-supplied input and ensuring proper escaping before displaying it on the affected pages.
Related vulnerabilities
Recent vulnerabilities recorded for eu.markov.jenkins.plugin.mvnmeta:maven-metadata-plugin.
