CVE-2023-25762: Cross-site Scripting in Jenkins Pipeline: Build Step Plugin
Summary
CVE-2023-25762: Cross-site Scripting in Jenkins Pipeline: Build Step Plugin. Affects org.jenkins-ci.plugins:pipeline-build-step versions < 2.18.1. Fixed in 2.18.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Pipeline: Build Step Plugin is a Maven package that provides functionality for creating and managing pipelines in Jenkins. It allows users to define complex build workflows using a Groovy-based scripting language. The plugin is widely used in software development and continuous integration processes.
Vulnerability Detail
The Jenkins Pipeline: Build Step Plugin version 2.18 and earlier is vulnerable to a stored cross-site scripting (XSS) attack. The vulnerability arises from the plugin's failure to properly escape job names in a JavaScript expression used in the Pipeline Snippet Generator. This allows attackers with control over job names to inject malicious scripts into the generated pipeline code. If successfully exploited, this vulnerability can lead to unauthorized access, data theft, and potential compromise of the Jenkins environment.
How To Fix
Minimum fixed version
2.18.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually escape job names in the Pipeline Snippet Generator by ensuring that any user-controlled input is properly sanitized and escaped before being used in the JavaScript expression. This can be achieved by using appropriate encoding functions or libraries specific to the programming language being used in the pipeline script.
Conclusion
The Jenkins Pipeline: Build Step Plugin version 2.18 and earlier is vulnerable to a stored cross-site scripting (XSS) attack. Users are advised to upgrade to the latest version of the plugin (2.19 or later) to mitigate this vulnerability. In the meantime, users can apply a temporary workaround by manually escaping job names in the Pipeline Snippet Generator. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:pipeline-build-step →
FAQ
If exploited, this vulnerability allows attackers to execute arbitrary JavaScript code in the context of the Jenkins environment, potentially leading to unauthorized access, data theft, and compromise of the Jenkins server.
No, only versions 2.18 and earlier are affected. Users of later versions are not vulnerable to this specific issue.
At the time of this advisory, there are no known public exploits targeting this vulnerability. However, it is advisable to apply the recommended fix as soon as possible to mitigate any potential risks.
Yes, this vulnerability can be exploited remotely by attackers who have the ability to control job names in the Jenkins environment.
Yes, the CVSS score for this vulnerability is 5.4, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:pipeline-build-step.
