CVE-2022-34191: Cross-site Scripting in Jenkins NS-ND Integration Performance Publisher Plugin
Summary
CVE-2022-34191: Cross-site Scripting in Jenkins NS-ND Integration Performance Publisher Plugin. Affects io.jenkins.plugins:cavisson-ns-nd-integration versions < 4.8.0.129. Fixed in 4.8.0.129. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins NS-ND Integration Performance Publisher Plugin is a Maven package (io.jenkins.plugins:cavisson-ns-nd-integration) that integrates with Jenkins to provide performance testing capabilities. It allows users to configure and publish performance test results. However, versions 4.8.0.77 and earlier of the plugin are vulnerable to a stored cross-site scripting (XSS) attack.
Vulnerability Detail
The vulnerability arises from the plugin's failure to properly escape the name of NetStorm Test parameters on views displaying parameters. This allows attackers with Item/Configure permission to inject malicious scripts into the application. Exploitation of this vulnerability requires that parameters are listed on another page, such as the 'Build With Parameters' and 'Parameters' pages provided by Jenkins. If these pages are not hardened to prevent exploitation, an attacker can execute arbitrary code in the context of the user's browser. Jenkins (core) has implemented measures to prevent exploitation of similar vulnerabilities since version 2.44 and LTS 2.32.2. Several plugins have also been updated to prevent exploitation by default.
How To Fix
Minimum fixed version
4.8.0.129
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of the plugin is not immediately feasible, users can implement the following workaround to mitigate the risk of exploitation:
- Ensure that the 'Build With Parameters' and 'Parameters' pages provided by Jenkins are hardened against XSS attacks. This can be achieved by applying the necessary security patches or updates to Jenkins (core).
- Regularly monitor the Jenkins Security Advisory page for any updates or patches related to this vulnerability.
Conclusion
The Jenkins NS-ND Integration Performance Publisher Plugin versions 4.8.0.77 and earlier are vulnerable to a stored cross-site scripting (XSS) attack. To mitigate this vulnerability, users should upgrade to version 4.8.0.129 or later of the plugin. Alternatively, they can implement workarounds to harden the 'Build With Parameters' and 'Parameters' pages provided by Jenkins. Regularly monitoring the Jenkins Security Advisory page is also recommended. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for io.jenkins.plugins:cavisson-ns-nd-integration →
FAQ
This vulnerability allows attackers to execute arbitrary code in the context of the user's browser. They can potentially steal sensitive information, perform actions on behalf of the user, or manipulate the application's behavior.
No, this vulnerability requires attackers to have Item/Configure permission in Jenkins. However, once exploited, the impact can be significant.
Yes, Jenkins (core) has implemented measures to prevent exploitation of similar vulnerabilities since version 2.44 and LTS 2.32.2. It is recommended to keep Jenkins (core) up to date to benefit from these security enhancements.
The Jenkins NS-ND Integration Performance Publisher Plugin is the only known plugin affected by this specific vulnerability. However, it is advisable to regularly check the Jenkins Security Advisory page for any updates or patches related to other plugins.
Yes, you can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software, using just the pom.xml file.
References
Related vulnerabilities
Recent vulnerabilities recorded for io.jenkins.plugins:cavisson-ns-nd-integration.
