CVE-2022-43433 in ScreenRecorder Plugin
Summary
by MITRE • 10/19/2022
Jenkins ScreenRecorder Plugin 0.7 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 05/09/2025
The vulnerability identified as CVE-2022-43433 affects the Jenkins ScreenRecorder Plugin version 0.7 and earlier, presenting a critical security risk through its improper handling of content security policies. This flaw specifically targets the plugin's mechanism for managing user-generated content within Jenkins workspaces and archived artifacts that are made available for download. The vulnerability stems from the plugin's programmatic disabling of Content-Security-Policy protections, which are fundamental web security mechanisms designed to prevent cross-site scripting attacks and other code injection vulnerabilities. When Content-Security-Policy is disabled, the system becomes vulnerable to malicious content execution within the context of the Jenkins server, potentially allowing attackers to inject and execute arbitrary scripts against users who download or interact with affected artifacts.
The technical exploitation of this vulnerability occurs when the ScreenRecorder Plugin processes user-generated content and automatically removes Content-Security-Policy headers from downloadable artifacts. This behavior creates a security boundary violation where the plugin intentionally weakens security controls for content that flows through its processing pipeline. The flaw essentially undermines the principle of least privilege and defense in depth by removing browser-based protections that would normally prevent malicious scripts from executing in the context of Jenkins user sessions. This type of vulnerability aligns with CWE-16 Configuration and CWE-352 Cross-Site Request Forgery, as it creates opportunities for attackers to manipulate security settings and inject malicious content into downloadable artifacts.
The operational impact of CVE-2022-43433 extends beyond simple code injection risks, as it creates persistent security weaknesses in Jenkins environments where the plugin is installed. Attackers who can influence the content processed by the ScreenRecorder Plugin can craft malicious artifacts that, when downloaded or viewed by other users, execute arbitrary code in their browsers. This risk is particularly severe in enterprise environments where Jenkins servers host sensitive build artifacts and user-generated content. The vulnerability can be leveraged through various attack vectors including supply chain compromises, where malicious actors upload crafted artifacts to repositories, or through direct exploitation of the plugin's functionality by authenticated users with appropriate privileges. The impact is further amplified by the fact that these artifacts are typically downloaded and executed in trusted environments, making the attack surface particularly dangerous.
Organizations affected by this vulnerability should immediately upgrade to Jenkins ScreenRecorder Plugin version 0.8 or later, which contains the necessary fixes to prevent the programmatic disabling of Content-Security-Policy protections. System administrators should conduct comprehensive audits of all Jenkins installations to identify affected plugin versions and ensure proper patch management procedures are in place. Additional mitigations include implementing network-level controls to monitor and restrict access to downloadable artifacts, configuring Jenkins with strict security headers, and establishing automated scanning processes to detect potentially malicious content in build artifacts. The vulnerability demonstrates the importance of maintaining security controls even within trusted internal systems and highlights the need for continuous monitoring of third-party plugins and their impact on overall security posture. Security teams should also consider implementing sandboxing mechanisms for user-generated content and establishing clear policies around plugin usage and security review processes to prevent similar issues in the future.