CVE-2025-53743
📋 TL;DR
Jenkins Applitools Eyes Plugin versions 1.16.5 and earlier expose Applitools API keys in plain text on job configuration forms. This allows attackers with access to Jenkins configuration interfaces to capture these sensitive credentials. Organizations using vulnerable plugin versions are affected.
💻 Affected Systems
- Jenkins Applitools Eyes Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers capture API keys and gain unauthorized access to Applitools services, potentially compromising visual testing results, accessing proprietary application screenshots, or incurring financial costs through API abuse.
Likely Case
Internal users or attackers with Jenkins access capture API keys, leading to unauthorized Applitools account access and potential data exposure.
If Mitigated
With proper access controls limiting Jenkins configuration access, risk is reduced to authorized users only.
🎯 Exploit Status
Exploitation requires access to Jenkins job configuration interface; no authentication bypass needed if user already has configuration access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.16.6 or later
Vendor Advisory: https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3510
Restart Required: Yes
Instructions:
1. Access Jenkins Manage Jenkins > Manage Plugins
2. Go to Available tab and search for 'Applitools Eyes Plugin'
3. Install version 1.16.6 or later
4. Restart Jenkins after installation
🔧 Temporary Workarounds
Restrict Jenkins Configuration Access
allLimit access to Jenkins job configuration pages to only authorized administrators
Rotate Applitools API Keys
allGenerate new API keys in Applitools dashboard and update Jenkins configurations
🧯 If You Can't Patch
- Implement strict access controls on Jenkins configuration interfaces
- Regularly rotate Applitools API keys and audit their usage
🔍 How to Verify
Check if Vulnerable:
Check Jenkins plugin manager for Applitools Eyes Plugin version; if version is 1.16.5 or earlier, system is vulnerable.Check Version:
curl -s http://jenkins-host/pluginManager/api/json?depth=1 | grep -o '"shortName":"applitools-eyes","version":"[^"]*"'Verify Fix Applied:
Verify plugin version is 1.16.6 or later in Manage Jenkins > Manage Plugins > Installed tab.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access to /job/*/configure pages
- Multiple failed authentication attempts to Jenkins configuration interfaces
Network Indicators:
- Unusual API calls to Applitools services from unexpected IPs
SIEM Query:
source="jenkins.log" AND (uri_path="/job/*/configure" OR message="*configure*" AND user!="admin_users")