ESB-2017.3119 - [Win][UNIX/Linux] Jenkins: Cross-site scripting - Existing account 2017-12-06

Printable version
PGP/GPG verifiable version

Hash: SHA256

             AUSCERT External Security Bulletin Redistribution

                   Jenkins Security Advisory 2017-12-05
                              6 December 2017


        AusCERT Security Bulletin Summary

Product:           Jenkins
Publisher:         Jenkins
Operating System:  UNIX variants (UNIX, Linux, OSX)
Impact/Access:     Cross-site Scripting -- Existing Account
Resolution:        Mitigation

Original Bulletin:

- --------------------------BEGIN INCLUDED TEXT--------------------

Jenkins Security Advisory 2017-12-05

This advisory announces a vulnerability in Jenkins (weekly and LTS) and 
various plugins.


Stored XSS vulnerability in tool names exploitable by administrators


Jenkins administrators can configure tools, such as JDK, Maven, or Ant, that 
will be available in job configurations for use by build scripts.

Some tool names are not properly escaped on job configuration forms, resulting
in a stored cross-site scripting vulnerability.

Tools confirmed to be affected are:

JDK (provided by Jenkins core)

Ant (provided by Ant plugin)

Others may also be affected by this.

This vulnerability can only be exploited by Jenkins administrators, as theyre
the only ones able to define tools. In regular Jenkins configurations, 
administrators are able to run any code and install any plugin. Therefore this
vulnerability only really affects installations that dont grant administrators
the Run Scripts, Configure Update Sites, and/or Install Plugins permissions.

As of publication of this advisory, there is no fix.

The Jenkins project has prepared a plugin preventing the configuration of 
unsafe tool names at If youre 
affected by this issue (i.e. are operating an instance restricting the 
permissions of administrators) we recommend installing the above plugin. You 
will need to build this plugin yourself. We are not planning to distribute it
on our update sites, as we are unaware of any open source plugins enabling a 
configuration that would be affected by this vulnerability.


SECURITY-624: medium

Affected versions

All versions of Jenkins


As of publication of this advisory, there is no fix available other than the 
workaround provided above.


The Jenkins project would like to thank the reporters for discovering and 
reporting these vulnerabilities:

Dhiraj Datar, Lakhshya Cyber Security Labs for SECURITY-624

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

Australian Computer Emergency Response Team
The University of Queensland
Qld 4072

Internet Email:
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.


« Back to bulletins