###################################################
1. ### Advisory Information ###
Title: SonarQube Jenkins Plugin - Plain Text Password
Date published: 2013-12-05
Date of last update: 2013-12-05
Vendors contacted: SonarQube and Jenkins CI
Discovered by: Christian Catalano
Severity: High
2. ### Vulnerability Information ###
CVE reference : CVE-2013-5676
CVSS v2 Base Score: 9.0
CVSS v2 Vector : (AV:N/AC:L/Au:S/C:C/I:C/A:C)
Component/s : Jenkins SonarQube Plugin
Class : plain text password
3. ### Introduction ###
Jenkins CI is an extendable open source continuous integration server
http://jenkins-ci.org.
Jenkins SonarQube Plugin allows you to trigger SonarQube analysis
from Jenkins CI using either a:
- Build step to trigger the analysis with the SonarQube Runner
- Post-build action to trigger the analysis with Maven
http://docs.codehaus.org/display/SONAR/Jenkins+Plugin
4. ### Vulnerability Description ###
The default installation and configuration of Jenkins SonarQube Plugin
in Jenkins CI is prone to a security vulnerability.
This vulnerability could be exploited by a remote attacker (a jenkins
malicious user with Manage Jenkins enabled) to obtain the SonarQube's
credentials.
5. ### Technical Description / Proof of Concept Code ###
Below is a harmless test that can be executed to check if a Jenkins
SonarQube Plugin installation is vulnerable.
Using a browser with a web proxy go to the following URL:
https://jenkinsserver:9444/jenkins/configure
check the parameter "sonar.sonarPassword" in Sonar installations section.
A vulnerable installation will show the password in plain text.
6. ### Business Impact ###
An attacker (a jenkins malicious user with Manage Jenkins enabled) can
obtain the SonarQube's credentials.
7. ### Systems Affected ###
This vulnerability was tested against:
Jenkins CI v1.523 and SonarQube Plugin v3.7
Older versions are probably affected too, but they were not checked.
8. ### Vendor Information, Solutions and Workarounds ###
There is the ability to encrypt the "sonar.password" property with the
SonarQube encryption mechanism:
http://docs.codehaus.org/display/SONAR/Settings+Encryption
The sonar.password property is only encryptable since SonarQube v3.7
9. ### Credits ###
This vulnerability has been discovered by:
Christian Catalano aka wastasy ch(dot)catalano(at)gmail(dot)com
10. ### Vulnerability History ###
August 21th, 2013: Vulnerability identification
September 4th, 2013: Vendor notification [Jenkins CI]
November 19th, 2013: Vulnerability confirmation [Jenkins CI]
November 29th, 2013: Vendor notification [SonarQube]
December 2nd, 2013: Vendor solution [SonarQube]
December 6th, 2013: Vulnerability disclosure
11. ### Disclaimer ###
The information contained within this advisory is supplied "as-is"
with no warranties or guarantees of fitness of use or otherwise.
I accept no responsibility for any damage caused by the use or misuse
of this information.
###################################################
