Jenkins Applitools Eyes Plugin API Key Storage Vulnerability

A vulnerability exists in the Jenkins Applitools Eyes Plugin in versions through 1.16.5, where Applitools API keys are stored unencrypted in job config.xml files on the Jenkins controller. This exposure allows users with Item/Extended Read permission or access to the Jenkins controller file system to view these API keys. The vulnerability is further compounded by the fact that the job configuration form does not mask the API keys, increasing the risk of unauthorized observation and capture.

Impact

The unencrypted storage of API keys in accessible job configuration files poses a risk of unauthorized access to Applitools services, potentially leading to misuse of those services or exposure of sensitive information.

Remediation

Users of the Jenkins Applitools Eyes Plugin should update to version 1.16.6, which encrypts the API keys when job configurations are saved and masks them in the configuration form.