Listen to this Post
The vulnerability exists due to inconsistent validation in the Jenkins Coverage Plugin. The plugin validates the “coverage results ID” field for malicious input, such as `javascript:` scheme URLs, only when a job is configured through the web UI. However, this validation is missing when coverage results are created or when a job is configured via the Jenkins REST API. An attacker with Item/Configure permission can exploit this by sending a crafted API request containing a `javascript:` URL as the coverage results ID. This malicious identifier is then stored persistently. When a user, such as an administrator or developer, views the coverage report in the Jenkins web interface, the stored `javascript:` URL is rendered as a clickable link. Clicking this link executes the attacker’s arbitrary JavaScript code in the context of the victim’s session.
dailycve form:
Platform: Jenkins Coverage Plugin
Version: ≤2.3054.ve1ff7b_a_a_123b_
Vulnerability : Stored XSS
Severity: High
date: 2025-12-10
Prediction: 2025-12-10
What Undercode Say:
Analytics
Check currently installed version of Coverage Plugin java -jar jenkins-cli.jar -s http://your-jenkins-host/ list-plugins | grep coverage Update the Coverage Plugin to the fixed version (example) java -jar jenkins-cli.jar -s http://your-jenkins-host/ install-plugin coverage:2.3056.v1dfe888b_0249
// Example of a vulnerable 'recordCoverage' step in a Pipeline script (to be avoided)
recordCoverage(
tools: [[parser: 'JACOCO']],
id: 'javascript:alert("XSS")', // Malicious payload in the ID parameter
name: 'Coverage Report'
)
How Exploit:
- Attacker with Item/Configure permission crafts a POST request to the Jenkins REST API to configure a job.
- The request sets the coverage results ID field to a `javascript:` scheme URL payload (e.g.,
javascript:alert(document.cookie)). - The plugin accepts and stores the malicious ID without validation.
- A victim user views the job’s coverage report page in Jenkins.
- The page renders the malicious ID as a link. When clicked, the JavaScript payload executes in the victim’s browser, potentially stealing session cookies or performing unauthorized actions.
Protection from this CVE
- Immediate Action: Update the Coverage Plugin to version 2.3056.v1dfe888b_0249 or later.
- Principle of Least Privilege: Strictly limit users with Item/Configure permission to only those who absolutely require it.
- Enable CSP: Enforce Content Security Policy in Jenkins (versions 2.539+), which can prevent the exploitation of this flaw.
- Input Validation: Review and ensure all plugins perform consistent validation on all input channels (UI, API, CLI).
Impact:
- Attackers can execute arbitrary JavaScript, leading to session hijacking, credential theft, or actions performed as the victim.
- Compromise of the Jenkins CI/CD environment integrity.
- Potential pivot point for further attacks within the development infrastructure.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
