CVE-2025-53665: Jenkins Apica Loadtest Plugin vulnerability exposes authentication tokens
4.3
Basic Information
JavaTechnical Details
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.apica:ApicaLoadtest | maven | <= 1.10 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability lies in the plaintext storage of the Apica Loadtest authentication token. My analysis of the source code confirms this. The LoadtestBuilderModel class, which serves as the data model for the plugin's configuration, defines a field authToken of type String. The constructor of this class, LoadtestBuilderModel(...), is annotated with @DataBoundConstructor. This annotation tells Jenkins to use this constructor to instantiate the object from the configuration form and then serialize it to XML for storage. Since the authToken is a simple String, it is written to the config.xml file in plaintext.
The getAuthToken() method is used to retrieve this token for use in API calls and for displaying it in the configuration UI. Because the UI does not treat it as a password field, the token is visible to anyone who can view the job configuration page.
The LoadtestBuilder class's constructor is the entry point for this entire process, as it is the main build step class that holds the configuration model.
Since there is no patch for this vulnerability, the evidence is taken directly from the source code of the plugin. The combination of @DataBoundConstructor and storing a sensitive value in a String field is the direct cause of this vulnerability.