-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:applitools-eyes | maven | <= 1.16.5 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the handling of the Applitools API key within the Jenkins Applitools Eyes Plugin. The plugin was storing the API key as a plain text string and using a standard text input field in the Jenkins UI for its configuration. This exposed the API key to anyone who could view the job configuration page.
The patch addresses this vulnerability by changing the data type of the API key from java.lang.String to hudson.util.Secret. The Secret class is a Jenkins-specific class designed to handle sensitive data. It encrypts the data when stored and can be decrypted only when needed. Additionally, the UI component for entering the API key was changed from <f:textbox> to <f:password>, which masks the input in the browser.
The identified vulnerable functions are the constructors of the main plugin classes (ApplitoolsBuildWrapper, ApplitoolsStep, ApplitoolsProjectConfigProperty) and the applitools methods in the ApplitoolsJobDsl class. These functions were responsible for accepting the API key from the user configuration and were all modified in the patch to handle the API key as a Secret.