CVE-2023-43495

Vulnerability

Overview

Jenkins 2.423 and earlier, and LTS 2.414.1 and earlier, do not escape the value of the caption constructor parameter of ExpandableDetailsNote. This class is used to annotate build log content with additional information that becomes visible when users interact with it. Because the caption value is not sanitized, a stored cross-site scripting (XSS) vulnerability exists [1][2].

Exploitation

Details

Attackers who can control the caption parameter of ExpandableDetailsNote can inject arbitrary HTML or JavaScript. As noted in the advisory, the related API is not used within Jenkins core at the time of publication, and the Jenkins security team is not aware of any affected plugins. However, any plugin or script that uses ExpandableDetailsNote with an attacker-influenced caption could trigger this vulnerability. No additional authentication is required beyond the ability to supply the caption value through a Jenkins interface or plugin [2][3].

Impact

Successful exploitation results in stored XSS, allowing an attacker to execute arbitrary JavaScript in the context of a victim's browser when they view the affected build log. This could lead to session hijacking, credential theft, or other malicious actions on behalf of the victim user. The CVSS severity is rated High [1][2].

Mitigation

Jenkins 2.424 and LTS 2.414.2 escape the caption constructor parameter values, fixing this vulnerability. Users should upgrade immediately to these or later versions. As of the advisory date, no workarounds are available, and the Jenkins security team recommends applying the update [2][3].