CVE-2025-64147
📋 TL;DR
The Jenkins Curseforge Publisher Plugin 1.0 displays API keys in plain text on job configuration forms instead of masking them. This allows attackers with access to Jenkins configuration pages to capture these credentials. Jenkins administrators using this plugin are affected.
💻 Affected Systems
- Jenkins Curseforge Publisher Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers obtain API keys and use them to compromise external Curseforge accounts, potentially modifying or deleting published content.
Likely Case
Internal users or attackers with Jenkins access capture API keys for unauthorized access to Curseforge services.
If Mitigated
Limited exposure if Jenkins access is properly restricted and API keys are rotated after discovery.
🎯 Exploit Status
Requires access to Jenkins job configuration pages where API keys are displayed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1 or later
Vendor Advisory: https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3562
Restart Required: No
Instructions:
1. Update Jenkins Curseforge Publisher Plugin to version 1.1 or later via Jenkins Plugin Manager. 2. No restart required. 3. Verify API keys are now masked in configuration forms.
🔧 Temporary Workarounds
Restrict Jenkins Access
allLimit access to Jenkins configuration pages to authorized administrators only.
Rotate API Keys
allGenerate new API keys in Curseforge and update Jenkins configurations.
🧯 If You Can't Patch
- Remove API keys from Jenkins configurations and use alternative authentication methods.
- Implement strict access controls to prevent unauthorized users from viewing Jenkins configuration pages.
🔍 How to Verify
Check if Vulnerable:
Check if Jenkins Curseforge Publisher Plugin version is 1.0 in Jenkins Plugin Manager.Check Version:
Navigate to Jenkins > Manage Jenkins > Plugin Manager > Installed plugins and check Curseforge Publisher Plugin version.Verify Fix Applied:
Verify plugin version is 1.1 or later and API keys appear masked (as asterisks) in job configuration forms.📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to Jenkins configuration pages, especially from unauthorized users.
Network Indicators:
- Unusual API calls to Curseforge services from Jenkins server IPs at unexpected times.
SIEM Query:
source="jenkins.log" AND ("configuration" OR "job config") AND user NOT IN (authorized_admin_users)