CVE-2023-43499

Vulnerability

Overview

The Jenkins Build Failure Analyzer Plugin versions 2.4.1 and earlier fail to escape Failure Cause names when they are displayed in build logs. This lack of output encoding allows an attacker to inject arbitrary HTML and JavaScript into the log output, leading to a stored cross-site scripting (XSS) vulnerability [1][2].

Exploitation

Prerequisites

An attacker must have the ability to create or update Failure Causes within Jenkins. This typically requires at least the Job/Configure permission or equivalent administrative access. Once a malicious Failure Cause name is saved, any user who views a build log containing that cause will execute the injected script in their browser session [2].

Impact

Successful exploitation enables the attacker to execute arbitrary JavaScript in the context of the Jenkins web interface. This can lead to session hijacking, credential theft, or further compromise of the Jenkins instance and its connected systems [2].

Mitigation

The vulnerability is fixed in Build Failure Analyzer Plugin version 2.4.2 [3]. Users should upgrade immediately. No workarounds are available; the only remediation is to apply the updated plugin [2].