OX App Suite suffers from cross site scripting and server-side request forgery vulnerabilities.

Internal reference: OXUIB-1795  
Vulnerability type: CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS))  
Component: backend  
Report confidence: Confirmed  
Solution status: Fixed by Vendor  
Last affected revision: OX App Suite backend 7.10.5-rev50, OX App Suite backend 7.10.6-rev29  
First fixed revision: OX App Suite backend 7.10.5-rev51, OX App Suite backend 7.10.6-rev30  
Discovery date: 2022-07-29  
Solution date: 2022-10-21  
Disclosure date: 2023-02-08  
CVE: CVE-2022-37306  
CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)

Details:  
XSS using "upsell" triggers. Non-alphanumeric content can be injected by the user as JS content for the "upsell" module. As a result, the code will be executed during subsequent logins and opening the "Portal" application, enabling a persistent cross-site scripting attack vector.

Risk:  
Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface (e.g. redirecting to a third-party site). To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account. No publicly available exploits are known.

Solution:  
We improved the allow-list sanitizing algorithm to deal with non-alphanumeric code.

---

Internal reference: OXUIB-1933  
Vulnerability type: CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS))  
Component: frontend  
Report confidence: Confirmed  
Solution status: Fixed by Vendor  
Last affected revision: OX App Suite frontend 7.10.5-rev38, OX App Suite frontend 7.10.6-rev19  
First fixed revision: OX App Suite frontend 7.10.5-rev39, OX App Suite frontend 7.10.6-rev20  
Discovery date: 2022-09-26  
Solution date: 2022-10-21  
Disclosure date: 2023-02-08  
CVE: CVE-2022-43696  
CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)

Details:  
XSS using "upsell ads". HTML content can be injected by the user as JS content for the "upsell ads" module. As a result, the code will be executed during subsequent logins and opening the "Portal" application, enabling a persistent cross-site scripting attack vector.

Risk:  
Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface (e.g. redirecting to a third-party site). To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account. No publicly available exploits are known.

Solution:  
We improved the sanitization process for upsell ads.

---

Internal reference: MWB-1784  
Vulnerability type: CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS))  
Component: backend  
Report confidence: Confirmed  
Solution status: Fixed by Vendor  
Last affected revision: OX App Suite backend 7.10.5-rev50, OX App Suite backend 7.10.6-rev29  
First fixed revision: OX App Suite backend 7.10.5-rev51, OX App Suite backend 7.10.6-rev30  
Discovery date: 2022-08-16  
Solution date: 2022-10-25  
Disclosure date: 2023-02-08  
CVE: CVE-2022-43697  
CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)

Details:  
"Tracking" features can be used to inject arbitrary script code. In case activity tracking adapters are enabled but not defined, users can use jslob to define own tracking settings for an account. This allows adding arbitrary values to trigger a specific URL or load a library.

Risk:  
Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface (e.g. redirecting to a third-party site). To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account. No publicly available exploits are known.

Solution:  
We made the related jslob configuration endpoint read-only for users.

---

Internal reference: MWB-1823  
Vulnerability type: CWE-918 (Server-Side Request Forgery (SSRF))  
Component: backend  
Report confidence: Confirmed  
Solution status: Fixed by Vendor  
Last affected revision: OX App Suite backend 7.10.5-rev50, OX App Suite backend 7.10.6-rev29  
First fixed revision: OX App Suite backend 7.10.5-rev51, OX App Suite backend 7.10.6-rev30  
Discovery date: 2022-09-14  
Solution date: 2022-10-24  
Disclosure date: 2023-02-08  
CVE: CVE-2022-43698  
CVSS: 5.0 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N)

Details:  
SSRF using POP3 account updates. When changing a valid external POP3 mail account as a user, the operation to update the accounts settings did not consider deny-list values.

Risk:  
Server-initiated requests can be directed to internal resources that are restricted based on deny-list settings. This can be used to determine "internal" addresses and services, depending on measurement and content of error responses. While no data of such services can be exfiltrated, the risk is a violation of perimeter based security policies. No publicly available exploits are known.

Solution:  
We now check compliance with existing deny-list content when updating POP3 mail accounts.

---

Internal reference: MWB-1862  
Vulnerability type: CWE-918 (Server-Side Request Forgery (SSRF))  
Component: backend  
Report confidence: Confirmed  
Solution status: Fixed by Vendor  
Last affected revision: OX App Suite backend 7.10.5-rev50, OX App Suite backend 7.10.6-rev29  
First fixed revision: OX App Suite backend 7.10.5-rev51, OX App Suite backend 7.10.6-rev30  
Discovery date: 2022-10-06  
Solution date: 2022-11-07  
Disclosure date: 2023-02-08  
CVE: CVE-2022-43699  
CVSS: 5.0 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N)

Details:  
Mail account discovery can be abused for SSRF. The external E-Mail autodiscovery feature performs connections checks based on the E-Mail addresses host-part. Those do not take existing deny-lists into respect, allowing attackers with access to DNS records of a domain to redirect requests to illegal addresses.

Risk:  
Server-initiated requests can be directed to internal resources that are restricted based on deny-list settings. This can be used to determine "internal" addresses and services, depending on measurement and content of error responses. While no data of such services can be exfiltrated, the risk is a violation of perimeter based security policies. No publicly available exploits are known.

Solution:  
We check for compliance with existing deny-list content when performing mail account autodiscovery.

---

Internal reference: MWB-1882, DOCS-4580  
Vulnerability type: CWE-94 (Improper Control of Generation of Code ('Code Injection'))  
Component: office  
Report confidence: Confirmed  
Solution status: Fixed by Vendor  
Last affected revision: OX App Suite backend 7.10.5-rev50, OX App Suite backend 7.10.6-rev29, OX App Suite office 7.10.5-rev10, OX App Suite office 7.10.6-rev5  
First fixed revision: OX App Suite backend 7.10.5-rev51, OX App Suite backend 7.10.6-rev30, OX App Suite office 7.10.5-rev11, OX App Suite office 7.10.6-rev6  
Discovery date: 2022-10-19  
Solution date: 2022-10-21  
Disclosure date: 2023-02-08  
CVE: CVE-2022-42889  
CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Details:  
Apache Commons Text Update. A critical vulnerability at the Apache Commons Text library has been identified, which is used by OX App Suite and OX Documents. However, our products do not directly use the vulnerable StringSubstitutor class. Based on current knowledge that means our products are not vulnerable.

Risk:  
Remote Code Execution, see CVE-2022-42889. No publicly available exploits are known.

Solution:  
We provided a update for this library to resolve the risk as a precaution, in case custom implementations use the vulnerable class.

OX App Suite Cross Site Scripting / Server-Side Request Forgery

Jenkins Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the Pipeline Snippet Generator, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control job names.

**Cross-site Scripting in Jenkins Pipeline: Build Step Plugin**

Moderate severity GitHub Reviewed Published Feb 15, 2023 to the GitHub Advisory Database • Updated Feb 15, 2023

GHSA-9j65-3f2q-8q2r: Cross-site Scripting in Jenkins Pipeline: Build Step Plugin

Jenkins JUnit Plugin 1166.va_436e268e972 and earlier does not escape test case class names in JavaScript expressions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control test case class names in the JUnit resources processed by the plugin.

**Cross-site Scripting in Jenkins JUnit Plugin**

Moderate severity GitHub Reviewed Published Feb 15, 2023 to the GitHub Advisory Database • Updated Feb 15, 2023

GHSA-ph74-8rgx-64c5: Cross-site Scripting in Jenkins JUnit Plugin

Jenkins Email Extension Plugin 2.93 and earlier does not escape various fields included in bundled email templates, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control affected fields.

**Cross-site Scripting in Jenkins Email Extension Plugin**

High severity GitHub Reviewed Published Feb 15, 2023 to the GitHub Advisory Database • Updated Feb 15, 2023

GHSA-h97r-fchm-m23x: Cross-site Scripting in Jenkins Email Extension Plugin

Jenkins Email Extension Plugin 2.93 and earlier does not escape, sanitize, or sandbox rendered email template output or log output generated during template rendering, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create or change custom email templates.

GHSA-p2fr-mq9m-6w6p: Cross-site Scripting in Jenkins Email Extension Plugin

A missing permission check in Jenkins Azure Credentials Plugin 253.v887e0f9e898b and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

This advisory announces vulnerabilities in the following Jenkins deliverables:

*   Azure Credentials Plugin
*   Email Extension Plugin
*   JUnit Plugin
*   Pipeline: Build Step Plugin
*   Synopsys Coverity Plugin

**Descriptions****Stored XSS vulnerability in JUnit Plugin**

**SECURITY-3032 / CVE-2023-25761**  
**Severity (CVSS):** High  
**Affected plugin: junit**  
**Description:**

JUnit Plugin 1166.va\_436e268e972 and earlier does not escape test case class names in JavaScript expressions.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control test case class names in the JUnit resources processed by the plugin.

JUnit Plugin 1166.1168.vd6b\_8042a\_06de escapes affected test case class names in JavaScript expressions.

**Stored XSS vulnerability in Pipeline: Build Step Plugin**

**SECURITY-3019 / CVE-2023-25762**  
**Severity (CVSS):** High  
**Affected plugin: pipeline-build-step**  
**Description:**

Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the Pipeline Snippet Generator.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control job names.

Pipeline: Build Step Plugin 2.18.1 escapes job names in the affected JavaScript expression.

**XSS vulnerability in bundled email templates in Email Extension Plugin**

**SECURITY-2931 / CVE-2023-25763**  
**Severity (CVSS):** High  
**Affected plugin: email-ext**  
**Description:**

Email Extension Plugin bundled multiple preconfigured templates for notification emails. The Email Template Testing feature can be used to see what these and other templates would look like based on a given build.

Email Extension Plugin 2.93 and earlier does not escape various fields included in those email templates, like build display name, user display name, and the names of tests.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control affected fields.

Email Extension Plugin 2.93.1 escapes affected fields in bundled email templates.

**Stored XSS vulnerability in custom email templates in Email Extension Plugin**

**SECURITY-2934 / CVE-2023-25764**  
**Severity (CVSS):** High  
**Affected plugin: email-ext**  
**Description:**

Email Extension Plugin allows defining custom email templates using Config File Provider plugin as Jelly or Groovy files. The Email Template Testing feature can be used to see what these templates would look like based on a given build by specifying the managed: name prefix.

Email Extension Plugin 2.93 and earlier does not escape, sanitize, or sandbox rendered email template output or log output generated during template rendering.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create or change custom email templates.

Email Extension Plugin 2.93.1 renders email template previews inside a sandboxed iframe.

**Script Security sandbox bypass vulnerability in Email Extension Plugin**

**SECURITY-2939 / CVE-2023-25765**  
**Severity (CVSS):** High  
**Affected plugin: email-ext**  
**Description:**

Email Extension Plugin allows defining custom email templates using Config File Provider plugin as Jelly or Groovy files. When defined inside a folder, email templates need to be subject to Script Security protection (sandboxed execution or full-script approval).

In Email Extension Plugin 2.93 and earlier, templates defined inside a folder were not subject to Script Security protection.

This vulnerability allows attackers able to define email templates in folders to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

Email templates defined in folders are subject to sandbox protection in Email Extension Plugin 2.93.1.

**Missing permission checks in Azure Credentials Plugin allow enumerating credentials IDs**

**SECURITY-1757 / CVE-2023-25766**  
**Severity (CVSS):** Medium  
**Affected plugin: azure-credentials**  
**Description:**

Azure Credentials Plugin 253.v887e0f9e898b and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

An enumeration of credentials IDs in Azure Credentials Plugin 254.v64da\_8176c83a requires Overall/Administer permission.

**CSRF vulnerability and missing permission checks in Azure Credentials Plugin**

**SECURITY-1756 / CVE-2023-25767 (CSRF), CVE-2023-25768 (missing permission check)**  
**Severity (CVSS):** Medium  
**Affected plugin: azure-credentials**  
**Description:**

Azure Credentials Plugin 253.v887e0f9e898b and earlier does not perform permission checks in methods implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified web server.

Additionally, these form validation methods do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

These form validation methods require POST requests and Overall/Administer permission in Azure Credentials Plugin 254.v64da\_8176c83a.

**Missing permission checks in Synopsys Coverity Plugin allow enumerating credentials IDs**

**SECURITY-2793 (1) / CVE-2023-23850**  
**Severity (CVSS):** Medium  
**Affected plugin: synopsys-coverity**  
**Description:**

Synopsys Coverity Plugin 3.0.2 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

An enumeration of credentials IDs in Synopsys Coverity Plugin 3.0.3 requires the appropriate permissions.

**CSRF vulnerability and missing permission checks in Synopsys Coverity Plugin allow capturing credentials**

**SECURITY-2793 (2) / CVE-2023-23847 (CSRF), CVE-2023-23848 (missing permission check)**  
**Severity (CVSS):** High  
**Affected plugin: synopsys-coverity**  
**Description:**

Synopsys Coverity Plugin 3.0.2 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

Synopsys Coverity Plugin 3.0.3 requires POST requests and the appropriate permissions for the affected HTTP endpoints.

**Severity**

*   SECURITY-1756: Medium
*   SECURITY-1757: Medium
*   SECURITY-2793 (1): Medium
*   SECURITY-2793 (2): High
*   SECURITY-2931: High
*   SECURITY-2934: High
*   SECURITY-2939: High
*   SECURITY-3019: High
*   SECURITY-3032: High

**Affected Versions**

*   **Azure Credentials Plugin** up to and including 253.v887e0f9e898b
*   **Email Extension Plugin** up to and including 2.93
*   **JUnit Plugin** up to and including 1166.va\_436e268e972
*   **Pipeline: Build Step Plugin** up to and including 2.18
*   **Synopsys Coverity Plugin** up to and including 3.0.2

**Fix**

*   **Azure Credentials Plugin** should be updated to version 254.v64da\_8176c83a
*   **Email Extension Plugin** should be updated to version 2.93.1
*   **JUnit Plugin** should be updated to version 1166.1168.vd6b\_8042a\_06de
*   **Pipeline: Build Step Plugin** should be updated to version 2.18.1
*   **Synopsys Coverity Plugin** should be updated to version 3.0.3

These versions include fixes to the vulnerabilities described above. All prior versions are considered to be affected by these vulnerabilities unless otherwise indicated.

**Credit**

The Jenkins project would like to thank the reporters for discovering and reporting these vulnerabilities:

*   **Daniel Beck, CloudBees, Inc.** for SECURITY-2793 (1), SECURITY-2793 (2)
*   **Kevin Guerroudj, CloudBees, Inc.** for SECURITY-3019, SECURITY-3032
*   **Wadeck Follonier, CloudBees, Inc.** for SECURITY-1756, SECURITY-1757
*   **Yaroslav Afenkin, CloudBees, Inc.** for SECURITY-2931, SECURITY-2939
*   **Yaroslav Afenkin, CloudBees, Inc. and independently, Valdes Che Zogou** for SECURITY-2934

CVE-2023-25766: Jenkins Security Advisory 2023-02-15

A missing permission check in Jenkins Azure Credentials Plugin 253.v887e0f9e898b and earlier allows attackers with Overall/Read permission to connect to an attacker-specified web server.

CVE-2023-25768: Jenkins Security Advisory 2023-02-15

CVE-2023-25763: Jenkins Security Advisory 2023-02-15

In Jenkins Email Extension Plugin 2.93 and earlier, templates defined inside a folder were not subject to Script Security protection, allowing attackers able to define email templates in folders to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

Tag

#xss