CVE-2025-53656

Vulnerability

Description

The Jenkins ReadyAPI Functional Testing Plugin versions 1.11 and earlier stores SLM License Access Keys, client secrets, and passwords in plaintext within job configuration files (config.xml) on the Jenkins controller [1][3]. This occurs because the plugin writes these credentials into job configuration without encryption, violating the principle of secure credential storage.

Exploitation

Prerequisites

An attacker must have either the 'Item/Extended Read' permission on the affected job or direct access to the Jenkins controller's file system [1]. No other special network position or authentication is required beyond these permissions, as the credential data is stored in an easily accessible location.

Impact

A successful exploit allows the attacker to read sensitive credentials such as SLM license access keys, client secrets, and passwords [1][3]. These credentials could be reused to access other systems or services, potentially leading to broader compromise.

Mitigation

Status

There is currently no fix available for this plugin; it is listed among unresolved security issues in the 2025-07-09 advisory [2]. Users are advised to restrict 'Item/Extended Read' permissions to trusted users only and to monitor access to the Jenkins controller file system as a workaround until a patched version is released [2].