CVE-2022-45392: Plaintext Storage of a Password in Jenkins NS-ND Integration Performance Publisher Plugin

Background

The NS-ND Integration Performance Publisher Plugin is a plugin for Jenkins, an open-source automation server. This plugin allows users to integrate performance data from Cavisson NetStorm and NetDiagnostics tools into their Jenkins pipelines. It provides functionality to publish performance reports and metrics as part of the Jenkins job.

The vulnerability in the NS-ND Integration Performance Publisher Plugin allows passwords to be stored in plaintext in the job config.xml files on the Jenkins controller. This means that sensitive information, such as passwords, are not properly protected and can be accessed by attackers with Item/Extended Read permission or access to the Jenkins controller file system.

The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.

Vulnerability Detail

The NS-ND Integration Performance Publisher Plugin version 4.8.0.143 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller. This means that anyone with access to these files can view the passwords in plaintext. Attackers with Item/Extended Read permission or access to the Jenkins controller file system can exploit this vulnerability.

The impact of this vulnerability is that sensitive information, such as passwords, can be easily accessed by unauthorized individuals. This can lead to unauthorized access to systems, data breaches, and other security incidents.

The NS-ND Integration Performance Publisher Plugin version 4.8.0.146 addresses this vulnerability by encrypting passwords once job configurations are saved again.

Workaround

If upgrading to the latest version of the NS-ND Integration Performance Publisher Plugin is not immediately possible, users can manually encrypt the passwords in the job config.xml files. This can be done by editing the files and replacing the plaintext passwords with their encrypted versions.

Here is an example of how to encrypt a password using the Jenkins CLI:

$ java -jar jenkins-cli.jar -s http://jenkins-server encrypt-password 'mysecretpassword'

Replace http://jenkins-server with the URL of your Jenkins server and mysecretpassword with the actual password. The command will output the encrypted version of the password, which can then be used in the config.xml file.

Note that this workaround is not recommended as it requires manual intervention and may introduce human error. Upgrading to the latest version of the plugin is the recommended solution.

Conclusion

The NS-ND Integration Performance Publisher Plugin version 4.8.0.143 and earlier is vulnerable to plaintext storage of passwords in job config.xml files. This can lead to unauthorized access to sensitive information. To mitigate this vulnerability, it is recommended to upgrade to version 4.8.0.146 or later, which encrypts passwords in the config.xml files. If immediate upgrade is not possible, users can manually encrypt the passwords as a workaround. For further support on vulnerability remediation, you can contact DevNack.com.

See every vulnerability recorded for io.jenkins.plugins:cavisson-ns-nd-integration →

FAQ