Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability lies in the Jenkins IFTTT Build Notifier Plugin's failure to properly secure the IFTTT Maker Channel Key. The root cause is found in the IFTTTBuildNotifier.java file. The plugin uses a standard Java String field (private final String key;) to store this sensitive credential. When a user configures a job, the data is passed to the @DataBoundConstructor of the IFTTTBuildNotifier class. Jenkins then serializes the object's state, including the key field, directly into the job's config.xml file without any form of encryption. This results in the plaintext storage of the secret key on the Jenkins controller's filesystem. Any user with 'Item/Extended Read' permissions can view the job configuration XML and retrieve the key. The IFTTTBuildNotifier constructor is the entry point for this insecure data handling, as it accepts the key as a simple string, and the getKey() method is used to retrieve this insecurely stored key for API calls. The proper implementation would involve using the Jenkins Credentials Plugin API to store and retrieve the key securely.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:ifttt-build-notifier | maven | <= 1.2 |
