CVE-2022-34197: Cross-site Scripting in Jenkins Sauce OnDemand Plugin
Summary
CVE-2022-34197: Cross-site Scripting in Jenkins Sauce OnDemand Plugin. Affects org.jenkins-ci.plugins:sauce-ondemand versions < 1.205. Fixed in 1.205. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Sauce OnDemand Plugin is a Maven package that provides integration with Sauce Labs Browsers. It allows users to configure and manage Sauce Labs Browsers parameters in Jenkins views. This plugin is vulnerable to a stored cross-site scripting (XSS) attack, which can be exploited by attackers with Item/Configure permission. The vulnerability arises from the lack of proper escaping of the name and description of Sauce Labs Browsers parameters on views displaying parameters.
Vulnerability Detail
The vulnerability in the Jenkins Sauce OnDemand Plugin allows an attacker to inject malicious scripts into the name and description fields of Sauce Labs Browsers parameters. When these parameters are listed on certain pages, such as the 'Build With Parameters' and 'Parameters' pages, the injected scripts can be executed in the context of other users who view these pages. This can lead to various consequences, including unauthorized access to sensitive information, session hijacking, and the execution of arbitrary code.
How To Fix
Minimum fixed version
1.205
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually escape the name and description fields of Sauce Labs Browsers parameters before entering them in Jenkins views. This can be done by encoding special characters and HTML entities. However, applying the official fix by updating the plugin is strongly recommended.
Conclusion
The Jenkins Sauce OnDemand Plugin is vulnerable to a stored cross-site scripting (XSS) attack, which can be exploited by attackers with Item/Configure permission. To mitigate this vulnerability, it is recommended to update the plugin to version 1.205 or later. Users can also manually escape the affected fields as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:sauce-ondemand →
FAQ
The vulnerability allows an attacker to execute arbitrary scripts in the context of other users who view the affected pages. This can lead to unauthorized access to sensitive information, session hijacking, and the execution of malicious code.
Attackers with Item/Configure permission in Jenkins can exploit this vulnerability.
Updating the Jenkins Sauce OnDemand Plugin to version 1.205 or later is the recommended mitigation. Additionally, hardening the 'Build With Parameters' and 'Parameters' pages in Jenkins (core) can prevent the exploitation of this vulnerability.
Yes, Jenkins (core) has previously fixed vulnerabilities of this kind in the 'Build With Parameters' and 'Parameters' pages since version 2.44 and LTS 2.32.2 as part of the SECURITY-353 / CVE-2017-2601 fix.
Several plugins have been updated to prevent the exploitation of this vulnerability by default. For a list of these plugins, refer to the SECURITY-2617 advisory in the 2022-04-12 security advisory.
