CVE-2024-28149: Jenkins HTML Publisher Plugin Input Sanitization Vulnerability
Summary
CVE-2024-28149: Jenkins HTML Publisher Plugin does not properly sanitize input. Affects org.jenkins-ci.plugins:htmlpublisher versions >= 1.16, < 1.32.1. Fixed in 1.32.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins HTML Publisher Plugin is a Maven-based plugin that allows users to publish HTML reports as part of their Jenkins build process. It provides a convenient way to display and share HTML-based reports generated by various tools and frameworks. The plugin integrates with Jenkins and provides a user-friendly interface for configuring and publishing HTML reports. However, versions 1.16 through 1.32 of the plugin are vulnerable to a cross-site scripting (XSS) attack due to improper input sanitization. This vulnerability can be exploited by attackers with Item/Configure permission to execute malicious scripts and potentially access sensitive information on the Jenkins controller file system.
Vulnerability Detail
The Jenkins HTML Publisher Plugin versions 1.16 through 1.32 suffer from a lack of proper input sanitization. This allows attackers with Item/Configure permission to inject and execute arbitrary JavaScript code on the affected Jenkins instance. By exploiting this vulnerability, an attacker can perform cross-site scripting (XSS) attacks, potentially compromising the confidentiality, integrity, and availability of the Jenkins system. Additionally, the vulnerability can be used to determine the existence of specific paths on the Jenkins controller file system, aiding in further attacks or reconnaissance activities.
How To Fix
Minimum fixed version
1.32.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict Item/Configure permission to trusted individuals only. By limiting access to this permission, the risk of exploitation can be reduced. However, this workaround may not be feasible in environments where multiple users require Item/Configure permission. It is strongly recommended to apply the official fix by updating to the latest version of the Jenkins HTML Publisher Plugin.
Conclusion
The Jenkins HTML Publisher Plugin versions 1.16 through 1.32 are vulnerable to a cross-site scripting (XSS) attack due to improper input sanitization. This can allow attackers with Item/Configure permission to execute arbitrary JavaScript code and potentially access sensitive information on the Jenkins controller file system. To mitigate this vulnerability, it is recommended to update the plugin to version 1.32.1 or later. Users can also restrict Item/Configure permission as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:htmlpublisher →
FAQ
This vulnerability allows attackers to execute arbitrary JavaScript code on the affected Jenkins instance, potentially compromising the confidentiality, integrity, and availability of the system. It can also be used to gather information about the Jenkins controller file system.
Attackers with Item/Configure permission in Jenkins can exploit this vulnerability. This permission level allows users to configure job settings, including the HTML Publisher Plugin configuration.
There are no known instances of this vulnerability being exploited in the wild. However, it is crucial to apply the fix as soon as possible to prevent potential attacks.
No, this vulnerability requires an authenticated user with Item/Configure permission to exploit it. Remote exploitation is not possible unless an attacker gains unauthorized access to a user account with the necessary permissions.
Yes, you can use Vulert's playground (https://vulert.com/scanner) to check if your Jenkins instance is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, and using the playground does not require any signup or installation.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:htmlpublisher.
