CVE-2020-2212: Secret stored in plain text by Jenkins GitHub Coverage Reporter Plugin
Summary
CVE-2020-2212: Secret stored in plain text by Jenkins GitHub Coverage Reporter Plugin. Affects io.jenkins.plugins:github-coverage-reporter versions < 1.10. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Jenkins GitHub Coverage Reporter Plugin is a Maven package (io.jenkins.plugins:github-coverage-reporter) that provides functionality for reporting code coverage to GitHub. It allows users to store and manage GitHub access tokens for authentication purposes. However, versions 1.10 and earlier of the plugin store the GitHub access token in plain text in the global configuration file io.jenkins.plugins.gcr.PluginConfiguration.xml. This means that users with access to the Jenkins controller file system can view the token.
Vulnerability Detail
The vulnerability (CVE-2020-2212) in the Jenkins GitHub Coverage Reporter Plugin allows unauthorized access to the GitHub access token, which can lead to potential misuse of the token by malicious actors. This token provides access to the user's GitHub account and repositories, allowing them to perform actions on behalf of the user. The plain text storage of the token in the global configuration file makes it easily accessible to anyone with access to the Jenkins controller file system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, as a general best practice, it is recommended to regularly monitor and review access controls and permissions for Jenkins and its plugins. This includes restricting access to sensitive configuration files and regularly updating to the latest versions of plugins to benefit from security fixes.
Conclusion
In conclusion, the Jenkins GitHub Coverage Reporter Plugin versions 1.10 and earlier store the GitHub access token in plain text, making it accessible to unauthorized users with access to the Jenkins controller file system. To mitigate this vulnerability, it is crucial to upgrade to a secure version of the plugin and restrict access to the Jenkins controller file system. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.jenkins.plugins:github-coverage-reporter →
FAQ
The impact of this vulnerability is that unauthorized users with access to the Jenkins controller file system can view the GitHub access token stored in plain text. This token provides access to the user's GitHub account and repositories, potentially allowing malicious actors to perform actions on behalf of the user.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using just the pom.xml file, without requiring access to the code or installation.
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
There are no known exploits for this vulnerability at the time of this report. However, it is important to address the vulnerability promptly by upgrading to a secure version of the Jenkins GitHub Coverage Reporter Plugin.
If your application is affected by this vulnerability, it is recommended to upgrade to a version of the Jenkins GitHub Coverage Reporter Plugin that is not affected by this issue (version 1.11 or later). Additionally, review and strengthen access controls for the Jenkins controller file system to prevent unauthorized access.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
