SonarQube Jenkins Plugin - Plain Text Password

###################################################



1. ###  Advisory Information ###



Title: SonarQube Jenkins Plugin - Plain Text Password

Date published: 2013-12-05

Date of last update: 2013-12-05

Vendors contacted: SonarQube and Jenkins CI

Discovered by: Christian Catalano

Severity: High





2. ###  Vulnerability Information ###



CVE reference     : CVE-2013-5676

CVSS v2 Base Score: 9.0

CVSS v2 Vector    : (AV:N/AC:L/Au:S/C:C/I:C/A:C)

Component/s       : Jenkins SonarQube Plugin

Class             : plain text password





3. ### Introduction ###



Jenkins CI is an extendable open source continuous integration server

http://jenkins-ci.org.



Jenkins SonarQube Plugin  allows you to trigger SonarQube analysis

from Jenkins CI using either a:



- Build step to trigger the analysis with the SonarQube Runner

- Post-build action to trigger the analysis with Maven



http://docs.codehaus.org/display/SONAR/Jenkins+Plugin





4. ### Vulnerability Description ###



The default installation and configuration of Jenkins SonarQube Plugin

in Jenkins CI is prone to a security vulnerability.



This vulnerability could be exploited by a remote attacker (a jenkins

malicious user with Manage Jenkins enabled) to obtain the SonarQube's

credentials.





5. ### Technical Description / Proof of Concept Code ###



Below is a harmless test that can be executed to check if a Jenkins

SonarQube Plugin installation is vulnerable.



Using a browser with a web proxy go to the following URL:



https://jenkinsserver:9444/jenkins/configure



check the parameter "sonar.sonarPassword" in Sonar installations section.



A vulnerable installation will show the password in plain text.





6. ### Business Impact ###



An attacker (a jenkins malicious user with Manage Jenkins enabled) can

obtain the SonarQube's credentials.





7. ### Systems Affected ###



This vulnerability was tested against:

Jenkins CI v1.523 and SonarQube Plugin v3.7

Older versions are probably affected too, but they were not checked.





8. ### Vendor Information, Solutions and Workarounds ###



There is the ability to encrypt the "sonar.password" property with the

SonarQube encryption mechanism:



http://docs.codehaus.org/display/SONAR/Settings+Encryption



The sonar.password property is only encryptable since SonarQube v3.7





9. ### Credits ###



This vulnerability has been discovered by:

Christian Catalano aka wastasy ch(dot)catalano(at)gmail(dot)com





10. ### Vulnerability History ###



August   21th, 2013: Vulnerability identification

September 4th, 2013: Vendor notification [Jenkins CI]

November 19th, 2013: Vulnerability confirmation [Jenkins CI]

November 29th, 2013: Vendor notification [SonarQube]

December  2nd, 2013: Vendor solution [SonarQube]

December  6th, 2013: Vulnerability disclosure





11. ### Disclaimer ###



The information contained within this advisory is supplied "as-is"

with no warranties or guarantees of fitness of use or otherwise.

I accept no responsibility for any damage caused by the use or misuse

of this information.



###################################################