CVE-2018-1000426

Vulnerability

The Jenkins Git Changelog Plugin versions 2.6 and earlier contain a cross-site scripting (XSS) vulnerability in multiple view components: GitChangelogSummaryDecorator/summary.jelly, GitChangelogLeftsideBuildDecorator/badge.jelly, GitLogJiraFilterPostPublisher/config.jelly, and GitLogBasicChangelogPostPublisher/config.jelly. The plugin does not properly escape values derived from Git history before rendering them in Jenkins web interfaces. An attacker who can control the Git history parsed by the plugin (e.g., by contributing to a repository or manipulating commit messages, author names, or tag names) can inject arbitrary HTML. This vulnerability is identified in the Jenkins Security Advisory 2018-09-25 as SECURITY-1122 [1] and confirmed in the NVD entry [2].

Exploitation

To exploit this vulnerability, an attacker must have the ability to inject malicious content into the Git history that the Jenkins Git Changelog Plugin parses. This can be achieved by contributing commits with specially crafted commit messages, author names, or tag names to a repository that Jenkins monitors. No authentication beyond the ability to push to the repository is required from the attacker; the Jenkins job must be configured to use the Git Changelog Plugin. The XSS payload is then automatically rendered when Jenkins displays the changelog summary, build badge, or plugin configuration pages that reference the malicious Git history entries [1][2].

Impact

A successful XSS attack allows the attacker to execute arbitrary HTML and JavaScript in the context of a Jenkins user's browser session. This can lead to session hijacking, credential theft, or performing administrative actions on behalf of an authenticated Jenkins user. The scope of compromise is limited to the Jenkins web interface; the attacker does not gain direct access to the Jenkins server or underlying host beyond what the browser session permits [1].

Mitigation

Jenkins released version 2.7 of the Git Changelog Plugin on 2018-09-25 to address this vulnerability [1]. Users should upgrade to version 2.7 or later. For earlier versions that are no longer supported, no workaround is described in the available references. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of the publication date.