Sensitive information disclosure via log in com.bmuschko:gradle-vagrant-plugin

Vulnerability

Description The com.bmuschko:gradle-vagrant-plugin Gradle plugin logs system environment variables during execution, as seen in the GDKExternalProcessExecutor.groovy file [3]. This behavior inadvertently exposes sensitive information such as API keys or passwords that are stored as environment variables [1].

Exploitation

An attacker can obtain these credentials by accessing log output generated when the plugin is used in a public CI/CD environment, where logs may be visible to unauthorized parties [2]. The vulnerability requires no special privileges or user interaction, and the attack complexity is low [4].

Impact

Successful exploitation leads to disclosure of sensitive environment variables, which could include credentials for external services, posing a significant risk to confidentiality [4].

Mitigation

The issue is fixed in version 3.0.0 of the plugin [1][2]. Users should upgrade to this version or later to prevent logging of environment variables.