CVE-2020-2170

Vulnerability

Overview

CVE-2020-2170 is a stored cross-site scripting (XSS) vulnerability in the Jenkins RapidDeploy Plugin, versions 4.2 and earlier. The plugin retrieves a list of deployment packages from a remote RapidDeploy server and displays them in a table within the Jenkins web interface. The package names are not escaped before being rendered, allowing an attacker to inject malicious HTML or JavaScript code into the page [1][2].

Exploitation

Prerequisites

To exploit this vulnerability, an attacker must be able to control the package names on the remote RapidDeploy server that the Jenkins plugin connects to. This could be achieved by compromising the remote server, or by tricking the Jenkins administrator into configuring the plugin to connect to a malicious server. No additional authentication is required on the Jenkins side for the XSS to trigger when a user views the package table [1][3].

Impact

Successful exploitation results in stored XSS, meaning the injected script executes in the context of any Jenkins user who views the affected page. This can lead to session hijacking, credential theft, or arbitrary actions performed on behalf of the victim user within Jenkins, potentially compromising the entire Jenkins instance [1][2].

Mitigation

The vulnerability is fixed in RapidDeploy Plugin version 4.2.1. Users are strongly advised to upgrade to this version or later. No workarounds are available; the only remediation is to update the plugin [1][3].