CVE-2025-53678

Vulnerability

Details

The Jenkins User1st uTester Plugin versions 1.1 and earlier stores the uTester JWT token in plaintext within its global configuration file on the Jenkins controller [1][3]. This credential is not encrypted or masked, violating best practices for handling sensitive data. The configuration file is located on the controller's file system and is readable by any user with access to that file system.

Exploitation

Exploitation requires the attacker to have read access to the Jenkins controller's file system, either through direct shell access, a compromised Jenkins user with file read permissions, or another vulnerability that exposes file contents [1][2]. No additional authentication is needed beyond that file system access. The token is stored in the plugin's global configuration, which is typically located in the Jenkins home directory.

Impact

An attacker who retrieves the JWT token can use it to authenticate to the uTester service, potentially gaining unauthorized access to the uTester platform and its associated testing capabilities [1][4]. This could lead to data exposure or misuse of the uTester service on behalf of the Jenkins instance.

Mitigation

As of the Jenkins Security Advisory 2025-07-09, this issue remains unresolved; no patched version of the plugin has been released [1][2]. Users are advised to restrict access to the Jenkins controller file system, monitor for unauthorized access, and consider removing the plugin if it is not essential. The plugin's GitHub repository does not indicate any planned fix [4].