CVE-2023-33001: Jenkins HashiCorp Vault Plugin Improper Masking of Credentials
Summary
CVE-2023-33001: Jenkins HashiCorp Vault Plugin has improper masking of credentials. Affects com.datapipe.jenkins.plugins:hashicorp-vault-plugin versions < 360.v0a. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins HashiCorp Vault Plugin is a Maven package (com.datapipe.jenkins.plugins:hashicorp-vault-plugin) that integrates Jenkins with HashiCorp Vault, a secrets management tool. This plugin allows users to securely retrieve and use credentials stored in HashiCorp Vault within Jenkins pipelines. It provides functionality for accessing secrets and managing authentication tokens. However, versions 360.v0a_1c04cf807d and earlier of the plugin have a vulnerability that leads to improper masking of credentials in the build log.
Vulnerability Detail
The vulnerability in the Jenkins HashiCorp Vault Plugin occurs when credentials are printed in build steps executed on an agent, typically within a node block. If the push mode for durable task logging is enabled, the credentials are not properly masked with asterisks in the build log. This can expose sensitive information, such as authentication tokens or passwords, to unauthorized users who have access to the build log. The issue has a CVSS score of 4.3, indicating a moderate severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
To apply the temporary workaround, install the latest version of the Credentials Binding plugin (523.525.vb_72269281873) and configure it to mask credentials in the build log. This can be done by following the plugin's documentation and enabling the appropriate settings.
Conclusion
The Jenkins HashiCorp Vault Plugin has a vulnerability that allows sensitive credentials to be exposed in the build log. While there is no fix available at the moment, a temporary workaround provided by the Credentials Binding plugin can be applied. It is crucial to update the affected HashiCorp Vault Plugin to the latest version once a fix is released. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.datapipe.jenkins.plugins:hashicorp-vault-plugin →
FAQ
The vulnerability exposes sensitive credentials, such as authentication tokens and passwords, in the build log. This can lead to unauthorized access to protected resources and compromise the security of the Jenkins pipeline.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins instance is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for open-source vulnerabilities in real-time.
As of now, the only available mitigation is to apply the temporary workaround provided by the Credentials Binding plugin. It is recommended to update the affected HashiCorp Vault Plugin once a fix is released.
As of the publication of this advisory, there is no specific timeline for the fix. It is advisable to monitor the official Jenkins and HashiCorp Vault Plugin documentation for updates on the release of a fixed version.
Disabling push mode for durable task logging can mitigate the vulnerability, but it may impact the functionality of other plugins or features that rely on this mode. It is recommended to apply the temporary workaround and update the affected HashiCorp Vault Plugin once a fix is available.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.datapipe.jenkins.plugins:hashicorp-vault-plugin.
