CVE-2019-10366: Skytap Cloud CI Plugin stored credentials in plain text
Summary
CVE-2019-10366: Skytap Cloud CI Plugin stored credentials in plain text. Affects org.jenkins-ci.plugins:skytap versions < 2.07. Fixed in 2.07. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Skytap Cloud CI Plugin is a plugin for the Jenkins automation server that allows users to integrate their Jenkins jobs with the Skytap Cloud platform. It provides functionality for managing and provisioning Skytap Cloud resources as part of the Jenkins build process. The plugin is written in Java and is part of the Maven ecosystem. The vulnerability in this plugin allows credentials to be stored in plain text in the job config.xml files on the Jenkins master. This means that users with Extended Read permission or access to the master file system can view these credentials.
Vulnerability Detail
The vulnerability in the Skytap Cloud CI Plugin arises from the insecure storage of credentials. When configuring a job in Jenkins that uses the Skytap Cloud CI Plugin, the user is required to provide their Skytap Cloud credentials. These credentials are then stored in the job's config.xml file on the Jenkins master. However, instead of encrypting the credentials, they are stored in plain text. This means that anyone with access to the Jenkins master can view these credentials, potentially leading to unauthorized access to the Skytap Cloud resources. The vulnerability has a CVSS score of 6.5, indicating a moderate severity.
How To Fix
Minimum fixed version
2.07
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can manually encrypt the credentials stored in the job config.xml file. This can be done by using the Jenkins Credentials Plugin to create a new credential of type 'Username with password' or 'Secret text' and then referencing this credential in the Skytap Cloud CI Plugin configuration. By using the Credentials Plugin, the credentials will be securely stored in Jenkins and will not be exposed in plain text in the job config.xml file.
Conclusion
The Skytap Cloud CI Plugin vulnerability allows credentials to be stored in plain text, potentially leading to unauthorized access to Skytap Cloud resources. To fix this vulnerability, users should upgrade to version 2.07 or later of the plugin. Alternatively, they can use the Jenkins Credentials Plugin to manually encrypt the credentials. It is important to address this vulnerability promptly to mitigate the risk of unauthorized access and data breaches. For further support, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:skytap →
FAQ
The vulnerability allows unauthorized users with access to the Jenkins master to view the Skytap Cloud credentials stored in plain text. This can lead to unauthorized access to Skytap Cloud resources and potential data breaches.
You can use the Vulert Playground at Vulert Scanner to check if your Jenkins installation is affected by this vulnerability. Simply enter your Jenkins pom.xml file and the Vulert Playground will analyze it for any known vulnerabilities, including this one.
Yes, you can manually encrypt the credentials stored in the job config.xml file using the Jenkins Credentials Plugin. This will ensure that the credentials are securely stored and not exposed in plain text.
There are currently no known exploits for this vulnerability. However, it is recommended to upgrade the plugin or apply the workaround as soon as possible to mitigate the risk.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide guidance and assistance in fixing the vulnerability in your Jenkins installation.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:skytap.
