CVE-2013-5573

Step 1: Payload Delivery: An attacker crafts a malicious HTML or JavaScript payload. This payload is designed to execute arbitrary code within a victim's browser.

Step 2: Payload Injection: The attacker logs into the Jenkins instance (or leverages an existing account) and navigates to the user configuration page (or a page where the description field is editable).

Step 3: Payload Insertion: The attacker enters the crafted payload into the 'Description' field within their user configuration.

Step 4: Payload Persistence: The attacker saves the user configuration, storing the malicious payload within the Jenkins database.

Step 5: Victim Interaction: A legitimate user, typically an administrator, views the user configuration page (e.g., by browsing user lists or viewing the attacker's profile).

Step 6: Payload Execution: The Jenkins server renders the user configuration, including the attacker's description. Due to the lack of proper sanitization, the attacker's JavaScript payload executes within the victim's browser context.

Step 7: Attack Execution: The injected JavaScript executes, allowing the attacker to perform actions such as stealing session cookies, redirecting the user to a phishing site, or executing other client-side attacks.

The vulnerability stems from insufficient input validation and output encoding within Jenkins' default markup formatter when rendering the user configuration description. Specifically, the application fails to properly sanitize user-supplied input before displaying it. This allows an attacker to inject malicious JavaScript code within the description field. When a user, especially an administrator, views the user configuration, the injected script executes in their browser, enabling the attacker to steal session cookies, redirect the user, or execute other client-side attacks. The root cause is a lack of proper HTML escaping or contextual output encoding of the description field content.