PT-2022-26916 · Jenkins · Jenkins Xframium Builder Plugin+1

Daniel Beck · Published 2022-10-19 · Updated 2023-11-22 · CVE-2022-43432

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins XFramium Builder Plugin versions 1.0.22 and earlier

Description The issue allows cross-site scripting (XSS) attacks by users with the ability to control files in workspaces, archived artifacts, etc. This is because the Jenkins XFramium Builder Plugin programmatically disables Content-Security-Policy protection for user-generated content. The Content-Security-Policy header is normally set by Jenkins for static files served by Jenkins, such as workspaces, /userContent, or archived artifacts, unless a Resource Root URL is specified. However, the XFramium Builder Plugin globally disables this header, making it possible for attackers to exploit this weakness.

Recommendations For Jenkins XFramium Builder Plugin versions 1.0.22 and earlier, consider disabling the plugin until a patch is available to prevent cross-site scripting attacks. Restrict access to user-generated content in workspaces and archived artifacts to minimize the risk of exploitation. If possible, configure a Resource Root URL for Jenkins instances to prevent the global disabling of the Content-Security-Policy header.

Fix

Protection Mechanism Failure

Weakness Enumeration

CWE-693

Related Identifiers

CVE-2022-43432

GHSA-PX4X-HJM5-W8X3

Affected Products

Jenkins

Jenkins Xframium Builder Plugin

References · 6

• https://jenkins.io/security/advisory/2022-10-19/#SECURITY-2863 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-43432 · Security Note
• https://osv.dev/vulnerability/GHSA-px4x-hjm5-w8x3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-43432 · Vendor Advisory
• http://openwall.com/lists/oss-security/2022/10/19/3 · Note
• https://github.com/jenkinsci/xframium-plugin · Note