CVE-2026-84648: Jenkins stored XSS in system log viewer via agent log output SECURITY-3476

Jenkins 2.579 and earlier (LTS 2.568.2 and earlier) renders log record metadata — source, level, and timestamp — in the system log viewer without HTML escaping. An attacker who controls an agent process can publish a java.util.logging.LogRecord with an attacker-controlled sourceClassName (e.g. <svg/onload=…>). That record is captured in the agent-side ring buffer (SlaveComputer.LogHolder.SLAVE_LOG_HANDLER, attached agent-side to the hudson.slaves.SlaveComputer logger by SlaveInitializer during channel setup), fetched over the remoting channel when an administrator opens a log recorder page (/log/<name>/), and rendered raw into the HTML. This is a stored XSS in the administrator's session context. Jenkins 2.580 / LTS 2.568.3 fixes it by escaping the metadata with Util.xmlEscape.

• Package/component: Jenkins core (hudson.Functions#printLogRecordHtml, rendered by lib/hudson/logRecords.jelly on hudson.logging.LogRecorder pages).
• Affected versions: Jenkins ≤ 2.579, LTS ≤ 2.568.2.
• Risk: High (CVSS 8.8, AV:N/AC:L/PR:N/UI:R). Stored XSS in the system log viewer executes in an administrator's authenticated browser session, enabling session hijack and full controller compromise (e.g. crumb theft → /scriptText Groovy RCE chain legs CVE-2026-84649 / CVE-2026-84645).
• Attacker precondition: control of an agent process (malicious/compromised agent). The victim must open a log recorder page that targets the agent log namespace.

Impact Parity

• Disclosed/claimed maximum impact: stored XSS executing in an administrator's session (session hijack; stepping stone to RCE).
• Reproduced impact from this run: (see Evidence — filled from the runtime proof) unescaped attacker payload rendered on the real /log/agentlog/ page of Jenkins 2.579 served to an authenticated admin; headless-Chromium admin session executed the injected script, which exfiltrated the authenticated same-origin /whoAmI/api/json response to an attacker-controlled beacon. Jenkins 2.580 negative control renders the payload escaped and no beacon callback occurs.
• Parity: full.
• Not demonstrated: the downstream RCE chain legs (CVE-2026-84649 crumb theft, CVE-2026-84645 deserialization RCE) are separate tickets and out of scope here.

Root Cause

core/src/main/java/hudson/Functions.java (Jenkins 2.579), printLogRecordHtml(LogRecord r, LogRecord prior):

String[] oldParts = prior == null ? new String[4] : logRecordPreformat(prior);
String[] newParts = logRecordPreformat(r);
for (int i = 0; i < /* not 4 */3; i++) {
    newParts[i] = "<span class='" + (newParts[i].equals(oldParts[i]) ? "logrecord-metadata-old" : "logrecord-metadata-new") + "'>" + newParts[i] + "</span>";
}
newParts[3] = Util.xmlEscape(newParts[3]);

Only parts[3] (the message) is escaped. parts[0] (timestamp), parts[1] (source = sourceClassName [+ sourceMethodName], or loggerName when sourceClassName == null), and parts[2] (level) are concatenated into raw HTML. lib/hudson/logRecords.jelly then emits them with <j:out value="${parts[0..2]}"/>, which outputs raw (unescaped) HTML. A LogRecord whose sourceClassName is already set is not overwritten by Logger.log(LogRecord), so an attacker JVM fully controls this field.

Delivery path from the agent: SlaveComputer.SlaveInitializer (a MasterToSlaveCallable sent during setChannel) installs LogHolder.SLAVE_LOG_HANDLER (a RingBufferLogHandler) on the hudson.slaves.SlaveComputer logger inside the agent JVM. When an administrator views a LogRecorder page whose targets include that namespace, LogRecorder.getSlaveLogRecords() calls SlaveComputer.getLogRecords() → SlaveLogFetcher callable over the remoting channel → returns the agent ring buffer → records are rendered via the vulnerable function.

Fix (Jenkins 2.580): the same loop becomes

String cls = newParts[i].equals(oldParts[i]) ? "logrecord-metadata-old" : "logrecord-metadata-new";
newParts[i] = "<span class='" + cls + "'>" + Util.xmlEscape(newParts[i]) + "</span>";

Verified via git diff jenkins-2.579..jenkins-2.580 -- core/src/main/java/hudson/Functions.java and the added regression test test/src/test/java/hudson/logging/LogRecorderManagerTest.java#logRecorderPageDoesNotRenderUnescapedMetadata (@Issue("SECURITY-3967")).

Reproduction Steps

1. bundle/repro/reproduction_steps.sh (self-contained; requires Docker, Python 3, Node.js, curl, jq).
2. Per attempt (2 vulnerable on jenkins/jenkins:2.579, 2 fixed on jenkins/jenkins:2.580, fresh container each):
   • Starts Jenkins with an init groovy script that creates the admin account, an inbound (JNLP) agent node agent1, and a system log recorder agentlog targeting hudson.slaves.SlaveComputer at Level.ALL.
   • Downloads the real agent.jar from the running controller, compiles bundle/repro/agent/AgentXss.java against it inside the container, and connects an attacker-controlled agent process over the real JNLP4/remoting TCP boundary.
   • The agent publishes a LogRecord with sourceClassName = <svg/onload="fetch('/whoAmI/api/json').then(…exfiltrate to beacon…)"> under the hudson.slaves.SlaveComputer logger.
   • The administrator views http://127.0.0.1:18080/log/agentlog/ (curl capture of the raw HTML + response headers, and a headless-Chromium admin login + page visit).
3. Expected evidence:
   • Vulnerable: raw <svg/onload=…> payload present verbatim in the served HTML; headless admin browser executes it and the attacker beacon receives the marker plus the exfiltrated authenticated /whoAmI/api/json body.
   • Fixed: HTML contains only <svg/onload…; beacon never receives the marker.

Evidence

• bundle/logs/reproduction_steps.log — full run log.
• bundle/repro/proof/vulnerable_{1,2}/page.html — raw payload in served page (vulnerable).
• bundle/repro/proof/vulnerable_1/beacon-hit.txt, bundle/repro/proof/beacon.log — attacker beacon callbacks proving script execution in the admin session.
• bundle/repro/proof/vulnerable_{1,2}/agent.log — attacker agent channel + MALICIOUS_RECORD_PUBLISHED.
• bundle/repro/proof/fixed_{1,2}/page.html — escaped payload only (negative control).
• bundle/repro/proof/*/result.json — per-attempt structured results; bundle/repro/runtime_manifest.json — runtime evidence manifest with artifact hashes.
• Environment: jenkins/jenkins:2.579 (sha256:a7342867ea33efaacf825229d50b7fc77c144ecada9719ab4e32419f5d7412be), jenkins/jenkins:2.580, bundled JDK 21, Linux x86_64.

Recommendations / Next Steps

• Upgrade to Jenkins 2.580 / LTS 2.568.3 (metadata is escaped before rendering).
• Enforcing the Jenkins Content Security Policy (opt-in before the fix; default is report-only) mitigates script execution but does not fix the missing escaping.
• Treat agent hosts as within the threat boundary: any agent can inject HTML into controller UI pages viewed by admins.

Additional Notes

• The script is idempotent: every attempt uses a fresh container (no persistent JENKINS_HOME), and reruns rebuild all proof artifacts.
• Limitation: the browser execution proof uses headless Chromium via puppeteer; if Chromium cannot be installed in the replay sandbox, the script degrades to the HTML oracle only (raw vs escaped payload), which still directly demonstrates the missing escaping that the 2.580 fix addresses.
• The source metadata line is only rendered when consecutive records differ; the agent publishes a benign control record before the malicious one so the payload-bearing span is always rendered.