CVE-2024-28149: Jenkins HTML Publisher Plugin XSS Flaw

CVE-2024-28149 Overview

CVE-2024-28149 is a cross-site scripting (XSS) vulnerability in the Jenkins HTML Publisher Plugin. The plugin fails to properly sanitize user-supplied input in versions 1.16 through 1.32 inclusive. Attackers holding Item/Configure permission can inject malicious script content and probe the Jenkins controller file system to confirm whether specific paths exist. The flaw is tracked under [CWE-79] and was disclosed in the Jenkins Security Advisory published on March 6, 2024.

Critical Impact
Authenticated attackers with Item/Configure permission can execute stored XSS in the context of Jenkins users and enumerate files on the Jenkins controller file system.

Affected Products

Jenkins HTML Publisher Plugin 1.16
Jenkins HTML Publisher Plugin versions 1.17 through 1.31
Jenkins HTML Publisher Plugin 1.32

Discovery Timeline

2024-03-06 - Jenkins publishes Security Advisory SECURITY-3301
2024-03-06 - CVE-2024-28149 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-28149

Vulnerability Analysis

The Jenkins HTML Publisher Plugin archives and serves HTML reports produced by build jobs. Versions 1.16 through 1.32 do not sanitize input passed through the plugin's report configuration. An attacker with Item/Configure permission can supply crafted values that are later rendered without proper escaping, resulting in stored cross-site scripting in the context of other Jenkins users who view the report.

The same input handling flaw exposes a secondary information disclosure path. By supplying file system paths as report inputs, an attacker can observe differences in plugin behavior that reveal whether a given path exists on the Jenkins controller host. This can be used to map installed software, configuration directories, and credential storage locations prior to a follow-on attack.

Root Cause

The root cause is missing output encoding and insufficient input validation in the plugin's report-handling code paths. User-controlled strings are passed into HTML contexts and file system checks without neutralizing metacharacters or restricting path access. This aligns with [CWE-79], Improper Neutralization of Input During Web Page Generation.

Attack Vector

Exploitation requires a network-reachable Jenkins instance and an account with Item/Configure permission on a job that uses HTML Publisher. The attacker configures the plugin with malicious HTML or JavaScript payloads, or with candidate file system paths, and waits for a privileged user to render the report. No user interaction beyond viewing the published report is required. See the Jenkins Security Advisory #SECURITY-3301 and the Openwall OSS Security Update for advisory-level technical details. No verified proof-of-concept code is publicly available.

Detection Methods for CVE-2024-28149

Indicators of Compromise

Unexpected <script> tags, event handler attributes, or encoded JavaScript payloads within HTML Publisher report artifacts stored under $JENKINS_HOME/jobs/<job>/htmlreports/.
Job configuration changes made by non-administrator accounts holding Item/Configure, particularly modifications to HTML Publisher report directories or index pages.
Report configurations referencing absolute or traversal-style file paths outside the workspace, indicating file system probing attempts.

Detection Strategies

Inventory all Jenkins controllers and enumerate installed HTML Publisher Plugin versions. Flag any instance running 1.16 through 1.32.
Review Jenkins audit logs for config.xml mutations on jobs that include the htmlpublisher.HtmlPublisher post-build step.
Scan archived report content for script tags or inline event handlers that should not appear in build-generated HTML.

Monitoring Recommendations

Forward Jenkins access and audit logs to a centralized logging platform and alert on job configuration edits by low-privilege accounts.
Monitor outbound requests from browsers of Jenkins administrators immediately after HTML report views for signs of session token exfiltration.
Track plugin update events and generate alerts if HTML Publisher is downgraded to a vulnerable version.

How to Mitigate CVE-2024-28149

Immediate Actions Required

Upgrade the Jenkins HTML Publisher Plugin to a version later than 1.32 that includes the fix from advisory SECURITY-3301.
Audit Item/Configure permission assignments and remove the permission from accounts that do not require it.
Review existing HTML Publisher configurations for suspicious payloads or path values before granting access to updated reports.

Patch Information

Jenkins addressed the vulnerability in the HTML Publisher Plugin release referenced in Jenkins Security Advisory #SECURITY-3301. Administrators should install the fixed release through the Jenkins Update Center and restart the controller. Confirm the installed version via Manage Jenkins → Plugins after the upgrade.

Workarounds

Restrict Item/Configure permission through Jenkins role-based access control until patching is complete.
Enable the Jenkins Content-Security-Policy header to limit execution of inline scripts served from DirectoryBrowserSupport.
Isolate the Jenkins controller behind an authenticated reverse proxy to reduce exposure of published report endpoints.

bash

# Verify installed HTML Publisher Plugin version via Jenkins CLI
java -jar jenkins-cli.jar -s https://jenkins.example.com/ \
  list-plugins | grep -i htmlpublisher

# Tighten the default Content-Security-Policy for served artifacts
# Set in Jenkins system properties (jenkins.model.Jenkins startup args)
-Dhudson.model.DirectoryBrowserSupport.CSP="sandbox; default-src 'none'; img-src 'self'; style-src 'self';"