CVE-2022-36922

The Jenkins Lucene-Search Plugin, up to and including version 370.v62a5f618cd3a, contains a reflected cross-site scripting (XSS) vulnerability. The plugin does not escape the search query parameter when displaying it on the search results page, allowing an attacker to inject arbitrary HTML or JavaScript. This occurs because the default escaping feature of Jelly, the templating engine used by Jenkins, was disabled for this particular view [1][4].

To exploit this vulnerability, an attacker can craft a malicious URL that includes the injected script as part of the search query parameter. The target user must visit this crafted URL, which then executes the script in the context of their browser session. No authentication is required for exploitation, as the search functionality is typically accessible to unauthenticated users [1][3].

Successful exploitation enables the attacker to perform actions on behalf of the victim, potentially leading to theft of sensitive session tokens and other credentials, and the ability to perform arbitrary actions on the Jenkins instance as the victim user [3]. The Jenkins Security Advisory 2022-07-27 reported this as a medium-severity issue [1].

This vulnerability is fixed in a subsequent release of the Lucene-Search Plugin. Administrators are advised to update to the latest version of the plugin. The fix, as shown in the commit, enables escaping of all content displayed in the search result screen [4].