CVE-2022-34191

Vulnerability

Details

The Jenkins NS-ND Integration Performance Publisher Plugin (formerly Cavisson NS-ND Integration) versions 4.8.0.77 and earlier does not properly escape the name of NetStorm Test parameters when rendering them on views that display parameters. This results in a stored cross-site scripting (XSS) vulnerability [1][2]. The root cause is that parameter names are directly included in the HTML output without sanitization, allowing an attacker to inject arbitrary HTML or JavaScript [4].

Attack

Vector and Prerequisites

To exploit this vulnerability, an attacker must have Item/Configure permission on a Jenkins job that uses the NS-ND Integration Performance Publisher Plugin [1][2]. The attacker can set a malicious parameter name containing script code when configuring a NetStorm Test parameter. This name is then stored and later executed in the browser of any user who views the affected parameter display page, such as job configuration pages or build parameter prompts [1]. No additional authentication or network position is required beyond the initial Jenkins access.

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the Jenkins UI, potentially leading to session hijacking, credential theft, or other actions performed as the victim user. Since the XSS is stored, every visit to the affected view triggers the payload, increasing the persistence and reach of the attack [2].

Mitigation

The Jenkins Security Advisory 2022-06-22 recommends upgrading the plugin to version 4.8.0.78 or later [1]. The fix, visible in commit 5b6dc59, escapes the parameter name using h.escape(it.name) in the Jelly view [4]. Users who cannot upgrade should ensure that only trusted users have Item/Configure permission and avoid viewing parameter configurations from untrusted sources.