CVE-2022-34196: Cross-site Scripting in Jenkins REST List Parameter Plugin
Summary
CVE-2022-34196: Cross-site Scripting in Jenkins REST List Parameter Plugin. Affects io.jenkins.plugins:rest-list-parameter versions < 1.6.0. Fixed in 1.6.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins REST List Parameter Plugin is a Maven package that provides functionality for creating and managing REST list parameters in Jenkins. These parameters allow users to input a list of values for a build job. The plugin is commonly used in Jenkins instances to enhance the flexibility of build configurations.
Vulnerability Detail
The Jenkins REST List Parameter Plugin version 1.5.2 and earlier is vulnerable to a stored cross-site scripting (XSS) attack. The plugin fails to properly escape the name and description of REST list parameters when displaying them on certain views. This allows an attacker with Item/Configure permission to inject malicious scripts into the parameter fields, which can then be executed by unsuspecting users who view or interact with the affected pages. Exploitation of this vulnerability requires that the parameters are listed on pages like 'Build With Parameters' and 'Parameters' and that these pages are not hardened against XSS attacks.
How To Fix
Minimum fixed version
1.6.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually escape the parameter names and descriptions when configuring REST list parameters. This can be done by HTML-encoding the input values to prevent them from being interpreted as HTML or JavaScript code. Here is an example of how to HTML-encode a parameter name using Java:
import org.apache.commons.text.StringEscapeUtils;
String encodedName = StringEscapeUtils.escapeHtml4(name);
By applying this workaround, the risk of XSS attacks can be mitigated until the plugin is updated to a secure version.
Conclusion
The Jenkins REST List Parameter Plugin version 1.5.2 and earlier is vulnerable to a stored cross-site scripting (XSS) attack. To protect your Jenkins instance, it is recommended to upgrade to version 1.6.0 or later of the plugin and ensure that all pages displaying parameters are hardened against XSS attacks. Regularly updating plugins and Jenkins itself is crucial for maintaining a secure environment. For further assistance or support in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for io.jenkins.plugins:rest-list-parameter →
FAQ
This vulnerability allows an attacker to execute arbitrary scripts in the context of unsuspecting users who view or interact with the affected pages. This can lead to various malicious activities, such as stealing sensitive information, performing unauthorized actions on behalf of the user, or spreading malware.
An attacker with Item/Configure permission in Jenkins can exploit this vulnerability by injecting malicious scripts into the parameter fields. However, the impact of the attack depends on the permissions and privileges of the targeted users who view or interact with the affected pages.
Jenkins (core) has implemented measures to prevent the exploitation of similar vulnerabilities on the 'Build With Parameters' and 'Parameters' pages since version 2.44 and LTS 2.32.2. However, it is important to ensure that other plugins and custom pages that display parameters are also hardened against XSS attacks.
Applying proper input validation and output encoding techniques can help mitigate the risk of XSS attacks. Additionally, regularly updating plugins and Jenkins itself to the latest secure versions is crucial for maintaining a secure environment.
For more information about this vulnerability, you can refer to the Jenkins Security Advisory https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617. This advisory provides details about the vulnerability, affected versions, and recommended actions to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for io.jenkins.plugins:rest-list-parameter.
