CVE-2022-46686: Jenkins Custom Build Properties Plugin Cross-site Scripting Vulnerability
Summary
CVE-2022-46686: Jenkins Custom Build Properties Plugin vulnerable to Cross-site Scripting. Affects io.jenkins.plugins:custom-build-properties versions < 2.82.v16d5b. Fixed in 2.82.v16d5b. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins Custom Build Properties Plugin is a Maven package that provides functionality for customizing build properties and build summary pages in the Jenkins continuous integration and delivery platform. It allows users to set and display custom properties and build information. However, versions 2.79.vc095ccc85094 and earlier of the plugin are vulnerable to a stored cross-site scripting (XSS) attack. This means that attackers with the ability to set or change property values can inject malicious scripts into the Custom Build Properties and Build Summary pages, potentially compromising the security and integrity of the Jenkins environment.
Vulnerability Detail
The vulnerability in Jenkins Custom Build Properties Plugin arises from the lack of proper escaping of property values and build display names on the Custom Build Properties and Build Summary pages. This allows an attacker to inject arbitrary HTML or JavaScript code into the pages, which can be executed by unsuspecting users who view the affected pages. The impact of this vulnerability can range from stealing sensitive information, such as user credentials, to performing unauthorized actions on behalf of the user. The vulnerability has a CVSS score of 8.0, indicating a high severity level.
How To Fix
Minimum fixed version
2.82.v16d5b
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of the Jenkins Custom Build Properties Plugin is not immediately feasible, a temporary workaround is to disable the plugin or restrict access to the affected pages. Disabling the plugin will prevent the execution of any injected scripts, effectively mitigating the XSS vulnerability. However, this workaround may impact the functionality of the plugin and should only be considered as a temporary measure until the plugin can be updated to a secure version.
Conclusion
The Jenkins Custom Build Properties Plugin versions 2.79.vc095ccc85094 and earlier are vulnerable to a stored cross-site scripting (XSS) attack. This can be exploited by attackers to inject malicious scripts into the Custom Build Properties and Build Summary pages, potentially compromising the security of the Jenkins environment. To mitigate this vulnerability, it is recommended to upgrade to version 2.82.v16d5b_d3590c7 or later of the plugin. Additional security measures, such as regularly updating Jenkins and implementing strong access controls, should also be followed. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.jenkins.plugins:custom-build-properties →
FAQ
The vulnerability allows attackers to inject malicious scripts into the Custom Build Properties and Build Summary pages, potentially leading to the theft of sensitive information or unauthorized actions within the Jenkins environment.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins instance is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file to analyze the software.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability. However, it is important to promptly apply the recommended fix to mitigate the risk of potential attacks.
While upgrading to the latest version of the Jenkins Custom Build Properties Plugin is the primary mitigation measure, it is also recommended to follow general security best practices, such as regularly updating Jenkins and its plugins, implementing strong access controls, and monitoring for any suspicious activity within the Jenkins environment.
For more information about this vulnerability, you can refer to the GitHub Security Advisory GHSA-5g2c-j6v9-vf94 (https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-5g2c-j6v9-vf94/GHSA-5g2c-j6v9-vf94.json) or reach out to the Devnack support team at info@devnack.com.
