CVE-2022-34791: Cross-site Scripting in Jenkins Validating Email Parameter Plugin
Summary
CVE-2022-34791: Cross-site Scripting in Jenkins Validating Email Parameter Plugin. Affects io.jenkins.plugins:validating-email-parameter versions < 1.10. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Validating Email Parameter Plugin is a Maven package that provides functionality for validating email parameters in Jenkins. It allows users to define email parameters and validate them during build processes. This plugin is vulnerable to a stored cross-site scripting (XSS) attack due to improper escaping of the name and description of its parameter type. Additionally, it disables security hardening measures introduced in Jenkins 2.44 and LTS 2.32.2, leaving the 'Build With Parameters' and 'Parameters' pages susceptible to this type of vulnerability.
Vulnerability Detail
The vulnerability arises from the lack of proper escaping of user-supplied input in the name and description fields of the parameter type. Attackers with Item/Configure permission can exploit this vulnerability to inject malicious scripts into the affected pages. This can lead to the execution of arbitrary code in the context of the user's browser, potentially compromising sensitive information or performing unauthorized actions.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can manually escape the name and description fields of the parameter type when defining email parameters. This can be done by ensuring that any user-supplied input is properly sanitized and encoded to prevent script execution. Here is an example of how to escape the input using Java's StringEscapeUtils:
import org.apache.commons.lang.StringEscapeUtils;
String escapedName = StringEscapeUtils.escapeHtml(name);
String escapedDescription = StringEscapeUtils.escapeHtml(description);
Conclusion
The Jenkins Validating Email Parameter Plugin is vulnerable to a stored cross-site scripting (XSS) attack, allowing attackers with Item/Configure permission to execute arbitrary scripts in the affected pages. To mitigate this vulnerability, it is crucial to upgrade to version 1.11 or later of the plugin, which includes the necessary fixes and re-enables security hardening measures. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.jenkins.plugins:validating-email-parameter →
FAQ
This vulnerability allows attackers with Item/Configure permission to inject and execute arbitrary scripts in the affected pages. This can lead to various consequences, including the theft of sensitive information, unauthorized actions, and potential compromise of the Jenkins environment.
No, only versions 1.10 and earlier are affected by this vulnerability. Versions 1.11 and later include the necessary fixes to prevent script injection.
While there is no specific known exploit available, the vulnerability is considered high-risk due to the potential impact of arbitrary script execution. It is recommended to apply the necessary fixes as soon as possible.
No, this vulnerability requires attackers to have Item/Configure permission in the Jenkins environment. It cannot be exploited remotely without proper access.
Yes, the CVSS score for this vulnerability is 8.0, indicating a high severity level.
