Miggo Logo
Miggo Vulnerability Database
→
CVE-2023-30520

CVE-2023-30520: Jenkins Quay.io trigger Plugin Cross-site Scripting vulnerability

8.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2023-30520
GHSA ID
GHSA-2jgw-28qh-6mg8
EPSS Score
0.7274%
CWE
CWE-79
Published
4/12/2023
Updated
4/21/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.jenkins-ci.plugins:quayio-triggermaven<= 0.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from two key points: 1) Lack of URL scheme validation during webhook payload processing (allowing dangerous schemes like 'javascript:'), and 2) Unsafe rendering of the stored URL in the UI. While exact function names/paths aren't provided in advisories, Jenkins plugin conventions suggest webhook handlers (Java classes) and Jelly UI files are involved. The high confidence stems from the explicit description of the attack vector (unfiltered webhook URLs) and the XSS mechanism (stored payload execution).

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

J*nkins Qu*y.io tri***r Plu*in *.* *n* **rli*r *o*s not limit URL s***m*s *or r*pository *om*p*** URLs su*mitt** vi* Qu*y.io tri***r w***ooks. T*is r*sults in * stor** *ross-sit* s*riptin* (XSS) vuln*r**ility *xploit**l* *y *tt**k*rs **l* to su*mit *

Reasoning

T** vuln*r**ility st*ms *rom two k*y points: *) L**k o* URL s***m* v*li**tion *urin* w***ook p*ylo** pro**ssin* (*llowin* **n**rous s***m*s lik* 'j*v*s*ript:'), *n* *) Uns*** r*n**rin* o* t** stor** URL in t** UI. W*il* *x**t `*un*tion` n*m*s/p*t*s *