SonarQube Jenkins Plugin - Plain Text Password

###################################################

1. ###  Advisory Information ###

Title: SonarQube Jenkins Plugin - Plain Text Password
Date published: 2013-12-05
Date of last update: 2013-12-05
Vendors contacted: SonarQube and Jenkins CI
Discovered by: Christian Catalano
Severity: High


2. ###  Vulnerability Information ###

CVE reference     : CVE-2013-5676
CVSS v2 Base Score: 9.0
CVSS v2 Vector    : (AV:N/AC:L/Au:S/C:C/I:C/A:C)
Component/s       : Jenkins SonarQube Plugin
Class             : plain text password


3. ### Introduction ###

Jenkins CI is an extendable open source continuous integration server
http://jenkins-ci.org.

Jenkins SonarQube Plugin  allows you to trigger SonarQube analysis
from Jenkins CI using either a:

- Build step to trigger the analysis with the SonarQube Runner
- Post-build action to trigger the analysis with Maven

http://docs.codehaus.org/display/SONAR/Jenkins+Plugin


4. ### Vulnerability Description ###

The default installation and configuration of Jenkins SonarQube Plugin
in Jenkins CI is prone to a security vulnerability.

This vulnerability could be exploited by a remote attacker (a jenkins
malicious user with Manage Jenkins enabled) to obtain the SonarQube's
credentials.


5. ### Technical Description / Proof of Concept Code ###

Below is a harmless test that can be executed to check if a Jenkins
SonarQube Plugin installation is vulnerable.

Using a browser with a web proxy go to the following URL:

https://jenkinsserver:9444/jenkins/configure

check the parameter "sonar.sonarPassword" in Sonar installations section.

A vulnerable installation will show the password in plain text.


6. ### Business Impact ###

An attacker (a jenkins malicious user with Manage Jenkins enabled) can
obtain the SonarQube's credentials.


7. ### Systems Affected ###

This vulnerability was tested against:
Jenkins CI v1.523 and SonarQube Plugin v3.7
Older versions are probably affected too, but they were not checked.


8. ### Vendor Information, Solutions and Workarounds ###

There is the ability to encrypt the "sonar.password" property with the
SonarQube encryption mechanism:

http://docs.codehaus.org/display/SONAR/Settings+Encryption

The sonar.password property is only encryptable since SonarQube v3.7


9. ### Credits ###

This vulnerability has been discovered by:
Christian Catalano aka wastasy ch(dot)catalano(at)gmail(dot)com


10. ### Vulnerability History ###

August   21th, 2013: Vulnerability identification
September 4th, 2013: Vendor notification [Jenkins CI]
November 19th, 2013: Vulnerability confirmation [Jenkins CI]
November 29th, 2013: Vendor notification [SonarQube]
December  2nd, 2013: Vendor solution [SonarQube]
December  6th, 2013: Vulnerability disclosure


11. ### Disclaimer ###

The information contained within this advisory is supplied "as-is"
with no warranties or guarantees of fitness of use or otherwise.
I accept no responsibility for any damage caused by the use or misuse
of this information.

###################################################