CVE-2022-34807: Plaintext Storage of a Password in Jenkins Elasticsearch Query Plugin
Summary
CVE-2022-34807: Plaintext Storage of a Password in Jenkins Elasticsearch Query Plugin. Affects org.jenkins-ci.plugins:elasticsearch-query versions < 1.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Elasticsearch Query Plugin is a Maven package that provides functionality for querying Elasticsearch from Jenkins. It allows users to configure Elasticsearch connections and perform queries on Elasticsearch indexes. The plugin is commonly used in Jenkins environments to integrate with Elasticsearch for logging and monitoring purposes. However, versions 1.2 and earlier of the plugin suffer from a vulnerability that results in the plaintext storage of a password in the global configuration file org.jenkinsci.plugins.elasticsearchquery.ElasticsearchQueryBuilder.xml on the Jenkins controller. This file is accessible to users with access to the Jenkins controller file system.
Vulnerability Detail
The vulnerability in the Jenkins Elasticsearch Query Plugin allows an attacker with access to the Jenkins controller file system to view the stored password in plaintext. This can lead to unauthorized access to the Elasticsearch instance and potentially expose sensitive data. The vulnerability has a CVSS score of 3.3, indicating a low severity level. The CWE IDs associated with this vulnerability are CWE-256 (Unprotected Storage of Credentials) and CWE-522 (Insufficiently Protected Credentials).
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, as a general best practice, it is recommended to restrict access to the Jenkins controller file system to trusted users only. This can help mitigate the risk of unauthorized access to the stored password.
Conclusion
The Jenkins Elasticsearch Query Plugin is vulnerable to plaintext storage of a password, which can be accessed by users with file system access to the Jenkins controller. This can lead to unauthorized access to the Elasticsearch instance and potential exposure of sensitive data. To mitigate this vulnerability, it is recommended to upgrade to a non-affected version of the plugin and review and update any stored passwords or credentials. For further support, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:elasticsearch-query →
FAQ
The vulnerability allows an attacker with access to the Jenkins controller file system to view the stored password in plaintext. This can lead to unauthorized access to the Elasticsearch instance and potential exposure of sensitive data.
You can use the Vulert Playground at Vulert Scanner to check if your Jenkins installation is affected by this vulnerability. Simply enter your Jenkins application details and the playground will provide information on any vulnerabilities found.
There are no known exploits for this vulnerability at the time of this report. However, it is important to apply the recommended fix to prevent potential unauthorized access to the Elasticsearch instance.
Manually removing the stored password from the configuration file is not recommended, as it may cause issues with the functionality of the Jenkins Elasticsearch Query Plugin. It is best to follow the recommended fix and upgrade to a non-affected version of the plugin.
For further support on vulnerability remediation, you can reach out to info@devnack.com. The Devnack team can provide guidance and assistance in addressing this vulnerability.
