CVE-2023-25721
📋 TL;DR
The Veracode Scan Jenkins Plugin before version 23.3.19.0 exposes proxy credentials in job logs when specific configurations are enabled. Users with access to view job logs can discover these credentials, potentially compromising proxy authentication. This affects Jenkins administrators who have enabled proxy debugging and remote agent job scanning.
💻 Affected Systems
- Veracode Scan Jenkins Plugin
📦 What is this software?
Veracode by Veracode
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain proxy credentials, pivot through internal networks, intercept sensitive traffic, or launch attacks from the proxy's position.
Likely Case
Internal users with job log access discover proxy credentials, potentially using them for unauthorized network access or credential reuse attacks.
If Mitigated
Limited exposure with proper access controls and monitoring, but credentials still exposed in logs.
🎯 Exploit Status
Exploitation requires authenticated access to view job logs and specific plugin configurations.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 23.3.19.0
Vendor Advisory: https://docs.veracode.com/updates/r/c_all_int#veracode-jenkins-plugin-233190
Restart Required: Yes
Instructions:
1. Update Veracode Scan Jenkins Plugin to version 23.3.19.0 or later via Jenkins Plugin Manager. 2. Restart Jenkins to apply the update. 3. Verify the plugin version in Jenkins system information.
🔧 Temporary Workarounds
Disable Jenkins Global Debug
allTurn off Jenkins global system debug setting to prevent credential logging.
Navigate to Jenkins > Manage Jenkins > System Log > Log Levels, ensure debug is disabled for relevant components.
Restrict Job Log Access
allLimit which users can view job logs containing sensitive information.
Configure Jenkins security matrix to restrict 'View Job Log' permissions to trusted users only.
🧯 If You Can't Patch
- Disable the 'Connect using proxy' option or remove proxy credentials from plugin configuration.
- Implement strict access controls on Jenkins job logs and monitor for unauthorized access attempts.
🔍 How to Verify
Check if Vulnerable:
Check Jenkins plugin manager for Veracode Scan Plugin version. If version is below 23.3.19.0 and the three vulnerable configurations are enabled, the system is vulnerable.Check Version:
Navigate to Jenkins > Manage Jenkins > Plugin Manager > Installed tab, search for 'Veracode Scan'.Verify Fix Applied:
Confirm plugin version is 23.3.19.0 or higher in Jenkins plugin manager and verify proxy credentials are no longer visible in job logs.📡 Detection & Monitoring
Log Indicators:
- Proxy credentials (usernames/passwords) appearing in Jenkins job logs
- Debug-level logging containing authentication strings
Network Indicators:
- Unauthorized proxy authentication attempts from internal Jenkins users
SIEM Query:
source="jenkins.log" AND ("proxy" AND "password" OR "credentials" AND "debug")