CVE-2022-34192: Cross-site Scripting in Jenkins ontrack Jenkins Plugin
Summary
CVE-2022-34192: Cross-site Scripting in Jenkins ontrack Jenkins Plugin. Affects org.jenkins-ci.plugins:ontrack versions < 4.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins ontrack Jenkins Plugin is a Maven package that provides functionality for managing parameters in Jenkins views. It allows users to define and configure parameters for builds. However, versions 4.0.0 and earlier of the plugin are vulnerable to a stored cross-site scripting (XSS) attack. This vulnerability arises from the plugin's failure to properly escape the name of certain parameters when displaying them on views. Attackers with Item/Configure permission can exploit this vulnerability.
Vulnerability Detail
The vulnerability in Jenkins ontrack Jenkins Plugin allows attackers to inject malicious scripts into the name of Ontrack: Multi Parameter choice, Ontrack: Parameter choice, and Ontrack: SingleParameter parameters. When these parameters are displayed on views, the injected scripts are executed in the context of the user's browser, leading to potential XSS attacks. Exploitation of this vulnerability requires that parameters are listed on pages like 'Build With Parameters' and 'Parameters' and that these pages are not hardened against XSS attacks. Jenkins (core) has addressed similar vulnerabilities in its own pages since version 2.44 and LTS 2.32.2. Some plugins have also been updated to prevent exploitation by default.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can harden the 'Build With Parameters' and 'Parameters' pages to prevent XSS attacks. This can be achieved by implementing input validation and output encoding to ensure that any user-supplied data is properly sanitized before being displayed on these pages. Here is an example of how to implement input validation and output encoding in a Jenkins pipeline script:
stage('Build With Parameters') {
steps {
script {
def userInput = input(
id: 'userInput',
message: 'Enter parameters',
parameters: [
string(name: 'param1', description: 'Parameter 1'),
string(name: 'param2', description: 'Parameter 2')
]
)
// Validate and sanitize user input
def sanitizedParam1 = userInput.param1.replaceAll(/[<>&]/, '')
def sanitizedParam2 = userInput.param2.replaceAll(/[<>&]/, '')
// Use sanitized parameters in the build
// ...
}
}
}
This example demonstrates how to use regular expressions to remove any HTML tags or special characters that could be used in an XSS attack. By sanitizing user input in this way, the risk of XSS vulnerabilities can be significantly reduced.
Conclusion
The vulnerability in Jenkins ontrack Jenkins Plugin exposes users to the risk of cross-site scripting attacks. It is crucial to update to version 4.0.1 or later of the plugin to mitigate this risk. Implementing input validation and output encoding in the 'Build With Parameters' and 'Parameters' pages can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:ontrack →
FAQ
This vulnerability allows attackers to execute arbitrary scripts in the context of a user's browser. They can potentially steal sensitive information, perform actions on behalf of the user, or manipulate the appearance and behavior of the affected Jenkins views.
Attackers with Item/Configure permission in Jenkins can exploit this vulnerability. They need access to pages where parameters are listed, such as 'Build With Parameters' and 'Parameters'.
Yes, Jenkins (core) has addressed similar vulnerabilities in its own pages since version 2.44 and LTS 2.32.2. These fixes prevent the exploitation of XSS vulnerabilities in parameter names and descriptions.
Yes, several plugins have been updated to list parameters in a way that prevents exploitation by default. For a list of these plugins, refer to the Jenkins security advisory https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617.
The CVSS score of this vulnerability is 8.0, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:ontrack.
