CVE-2025-53668
📋 TL;DR
The Jenkins VAddy Plugin 1.2.8 and earlier stores VAddy API authentication keys unencrypted in job configuration files. This allows users with Item/Extended Read permission or filesystem access to view these sensitive credentials. Organizations using vulnerable Jenkins instances with the VAddy Plugin are affected.
💻 Affected Systems
- Jenkins VAddy Plugin
📦 What is this software?
Vaddy by Jenkins
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain access to VAddy API keys, potentially compromising the entire VAddy security scanning infrastructure and allowing unauthorized access to scan results or manipulation of scanning configurations.
Likely Case
Internal users with appropriate permissions or attackers who gain access to Jenkins filesystem can exfiltrate VAddy API keys, leading to unauthorized API calls and potential data exposure.
If Mitigated
With proper access controls and monitoring, impact is limited to authorized users who already have access to sensitive Jenkins configuration data.
🎯 Exploit Status
Exploitation requires either Item/Extended Read permission in Jenkins or direct filesystem access to the Jenkins controller.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.9 or later
Vendor Advisory: https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3527
Restart Required: Yes
Instructions:
1. Update Jenkins VAddy Plugin to version 1.2.9 or later via Jenkins Plugin Manager. 2. Restart Jenkins. 3. Regenerate any potentially exposed VAddy API keys.
🔧 Temporary Workarounds
Restrict Jenkins Filesystem Access
linuxLimit filesystem access to Jenkins controller to authorized administrators only.
chmod 700 /var/lib/jenkins
chown jenkins:jenkins /var/lib/jenkins
Review and Restrict Jenkins Permissions
allAudit and minimize users with Item/Extended Read permission in Jenkins.
🧯 If You Can't Patch
- Remove VAddy API keys from existing job configurations and store them securely elsewhere
- Implement strict access controls on Jenkins controller filesystem and audit access logs
🔍 How to Verify
Check if Vulnerable:
Check Jenkins plugin manager for VAddy Plugin version. If version is 1.2.8 or earlier, system is vulnerable.Check Version:
Check Jenkins web interface: Manage Jenkins > Plugin Manager > Installed plugins, or examine $JENKINS_HOME/plugins/vaddy/META-INF/MANIFEST.MFVerify Fix Applied:
Verify VAddy Plugin version is 1.2.9 or later in Jenkins plugin manager.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to Jenkins controller filesystem
- Unusual API calls to VAddy service from unexpected sources
Network Indicators:
- Unexpected outbound connections to VAddy API endpoints from non-Jenkins sources
SIEM Query:
source="jenkins" AND (event="filesystem_access" OR event="plugin_version") AND plugin="vaddy" AND version<="1.2.8"