CVE-2024-47197
📋 TL;DR
The Maven Archetype Plugin versions 3.2.1 through 3.2.x expose sensitive credentials by copying the user's settings.xml file into test artifacts. This affects developers who use the plugin for archetype integration testing and publish artifacts without cleaning build directories, potentially leaking authentication credentials to public repositories.
💻 Affected Systems
- Apache Maven Archetype Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Developer credentials (including passwords, API keys, tokens) are published to public repositories like Maven Central, allowing attackers to compromise build systems, deploy malicious artifacts, or access private repositories.
Likely Case
Credentials accidentally exposed in snapshot or test artifacts, potentially discovered through repository scanning tools or manual inspection.
If Mitigated
No credential exposure occurs due to proper build hygiene or credential management practices.
🎯 Exploit Status
Exploitation requires discovering published artifacts containing the leaked settings.xml file.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.3.0
Vendor Advisory: https://lists.apache.org/thread/ftg81np183wnyk0kg4ks95dvgxdrof96
Restart Required: No
Instructions:
1. Update Maven Archetype Plugin dependency to version 3.3.0 in pom.xml
2. Run mvn clean verify to ensure old artifacts are removed
3. Verify no settings.xml files exist in published artifacts
🔧 Temporary Workarounds
Always clean before verify
allRun mvn clean before mvn verify to prevent accumulation of sensitive files
mvn clean verify
Exclude sensitive files from artifacts
allConfigure build to exclude archetype-settings.xml from final artifacts
Add appropriate exclusions to pom.xml build configuration
🧯 If You Can't Patch
- Implement mandatory mvn clean before any verify operations in CI/CD pipelines
- Scan all published artifacts for settings.xml files and revoke any exposed credentials
🔍 How to Verify
Check if Vulnerable:
Check if archetype-settings.xml exists in target/classes/archetype-it/ directory after running mvn verify without cleanCheck Version:
mvn archetype:help | grep 'Apache Maven Archetype Plugin'Verify Fix Applied:
After upgrading to 3.3.0, verify that archetype-settings.xml is no longer created in test artifacts📡 Detection & Monitoring
Log Indicators:
- Build logs showing archetype-settings.xml being created or included in artifacts
Network Indicators:
- Artifact repository traffic containing settings.xml files
SIEM Query:
Search for file creation events matching '*archetype-settings.xml*' in build directories