CVE-2019-10291

Vulnerability

Jenkins Netsparker Cloud Scan Plugin version 1.1.5 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master [1][3]. This is a plaintext storage issue where sensitive information such as API tokens or authentication secrets are written without any cryptographic protection.

Exploitation

To exploit this vulnerability, an attacker requires access to the Jenkins master file system. This could be achieved through existing shell access, a separate file read vulnerability, or other means that allow reading the plugin's configuration file. No Jenkins user permissions beyond file system read are needed; the credentials are stored in plaintext and can be viewed directly [1].

Impact

An attacker with file system access can retrieve the stored credentials, potentially compromising the Netsparker Cloud service or other integrated systems. This could lead to unauthorized scanning, data exfiltration, or lateral movement within the CI/CD pipeline.

Mitigation

The Jenkins Security Advisory recommends updating to a newer version of the plugin that encrypts credentials [1]. Users should also restrict file system access to the Jenkins master and follow best practices for credential management.