PoC_CVE-2024-28157

CVE-2024-28157 - Stored XSS in Jenkins GitBucket Plugin <= 0.8

The GitBucket URL field in job configuration is not sanitized. Setting it to a javascript: URI stores the payload and executes it in any visitor's browser when they open the project status page.

Report https://report-cve-2024-28157.vercel.app/

Setup

bash poc/download-plugins
docker compose up --build

Jenkins runs on http://localhost:8080 Unlock with the admin password from: docker compose logs jenkins

Reproduce

1. Create a Freestyle project
2. Configure > GitBucket > URL: javascript:alert(7*7)
3. Save, then visit the project page
4. Alert fires with 49 (7*7)

Screenshots are in poc/screenshots/

References

NVD https://nvd.nist.gov/vuln/detail/CVE-2024-28157