CVE-2020-2314: Password stored in plain text by Jenkins AppSpider Plugin
Summary
CVE-2020-2314: Password stored in plain text by Jenkins AppSpider Plugin. Affects com.rapid7:jenkinsci-appspider-plugin versions < 1.0.13. Fixed in 1.0.13. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins AppSpider Plugin is a Maven package (com.rapid7:jenkinsci-appspider-plugin) that provides integration between Jenkins and the AppSpider security testing tool. It allows users to automate security scans of their applications as part of their Jenkins build process. The plugin stores configuration settings in a global configuration file called com.rapid7.jenkinspider.PostBuildScan.xml on the Jenkins controller. One of these settings is a password that is used for authentication with the AppSpider tool. Prior to version 1.0.13, this password was stored in plain text, making it vulnerable to unauthorized access by users with file system access to the Jenkins controller.
Vulnerability Detail
The vulnerability (CVE-2020-2314) in the Jenkins AppSpider Plugin allows users with file system access to the Jenkins controller to view the password used for authentication with the AppSpider tool. This password is stored in plain text in the global configuration file com.rapid7.jenkinspider.PostBuildScan.xml. An attacker with access to this file can obtain the password and potentially use it to gain unauthorized access to the AppSpider tool or other systems that use the same password. The vulnerability has a CVSS score of 3.3, indicating a low severity.
How To Fix
Minimum fixed version
1.0.13
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to version 1.0.13 is not immediately possible, a workaround is to manually encrypt the password in the com.rapid7.jenkinspider.PostBuildScan.xml file. This can be done using a suitable encryption algorithm or tool. However, this workaround is not recommended as it requires manual intervention and may introduce additional security risks.
Conclusion
The Jenkins AppSpider Plugin prior to version 1.0.13 stored the password used for authentication with the AppSpider tool in plain text, making it vulnerable to unauthorized access. Upgrading to version 1.0.13 or later of the plugin is recommended to fix this vulnerability. Alternatively, the password can be manually encrypted, but this is not recommended. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for com.rapid7:jenkinsci-appspider-plugin →
FAQ
The vulnerability allows users with file system access to the Jenkins controller to view the password used for authentication with the AppSpider tool. This could potentially lead to unauthorized access to the AppSpider tool or other systems that use the same password.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins installation is affected by this vulnerability. Simply provide your pom.xml file and Vulert will analyze it for open-source vulnerabilities, including this one.
There are no known public exploits for this vulnerability at the time of this report. However, it is still important to fix the vulnerability to prevent potential unauthorized access.
Yes, it is possible to manually encrypt the password in the com.rapid7.jenkinspider.PostBuildScan.xml file. However, this workaround is not recommended as it requires manual intervention and may introduce additional security risks. It is best to upgrade to version 1.0.13 or later of the AppSpider Plugin.
You can find more information about this vulnerability in the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-rm7r-xv53-xwc3/GHSA-rm7r-xv53-xwc3.json
Related vulnerabilities
Recent vulnerabilities recorded for com.rapid7:jenkinsci-appspider-plugin.
