CVE-2019-10298

Vulnerability

Jenkins Koji Plugin stores credentials unencrypted in its global configuration file on the Jenkins master. Users with access to the master file system can view these credentials [1]. The vulnerability affects all versions of the plugin up to and including the latest version at the time of disclosure.

Exploitation

An attacker requires access to the Jenkins master file system, either through direct shell access or by exploiting another vulnerability that provides file read capabilities. No additional authentication is needed beyond file system access. The attacker can read the configuration file containing the credentials.

Impact

Successful exploitation results in the disclosure of stored credentials, such as API tokens or passwords, which can be used to gain unauthorized access to external services configured with the plugin [2].

Mitigation

As of the advisory on 2019-04-03, there is no fix provided for the Koji Plugin. Users should ensure that only trusted users have file system access to the Jenkins master and consider using Jenkins' credential encryption features if available [1].