CVE-2020-2312: Password Leakage in Jenkins SQLPlus Script Runner Plugin
Summary
CVE-2020-2312: Password written to the build log by Jenkins SQLPlus Script Runner Plugin. Affects org.jenkins-ci.plugins:sqlplus-script-runner versions < 2.0.13. Fixed in 2.0.13. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Jenkins SQLPlus Script Runner Plugin is a Maven package (org.jenkins-ci.plugins:sqlplus-script-runner) that allows users to execute SQL scripts using the SQLPlus command-line tool. It provides integration with Jenkins, a popular open-source automation server. The plugin enables users to run SQL scripts as part of their build process, facilitating database operations within Jenkins pipelines.
Vulnerability Detail
The SQLPlus Script Runner Plugin version 2.0.12 and earlier suffers from a vulnerability where the plugin writes the sqlplus command invocation, including any provided password, to the build log. This log message is accessible to users with Item/Read permission. As a result, the password can be viewed by unauthorized users, potentially leading to unauthorized access to the database or other sensitive information. The vulnerability has been assigned the CVE identifier CVE-2020-2312 and a CVSS score of 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
How To Fix
Minimum fixed version
2.0.13
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading the plugin is not immediately feasible, a temporary workaround is to avoid passing the password as a command line argument to the sqlplus command. Instead, consider using alternative methods to securely provide the password, such as storing it in a secure credential store or using environment variables.
Conclusion
The Jenkins SQLPlus Script Runner Plugin version 2.0.12 and earlier suffer from a vulnerability that exposes passwords provided as command line arguments to unauthorized users. To mitigate this issue, it is recommended to upgrade to version 2.0.13 or later of the plugin. Alternatively, users can employ workarounds such as avoiding passing passwords as command line arguments and using secure credential stores or environment variables. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:sqlplus-script-runner →
FAQ
The vulnerability allows unauthorized users with Item/Read permission to view passwords provided as command line arguments to the sqlplus command. This can lead to unauthorized access to databases or other sensitive information.
Versions 2.0.12 and earlier of the SQLPlus Script Runner Plugin are affected by this vulnerability.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this one.
Yes, the vulnerability has been fixed in version 2.0.13 of the SQLPlus Script Runner Plugin. It is recommended to upgrade to this version or later to mitigate the vulnerability.
A temporary workaround is to avoid passing the password as a command line argument to the sqlplus command. Instead, consider using alternative methods to securely provide the password, such as storing it in a secure credential store or using environment variables.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
