Jenkins Applitools Eyes Plugin API Key Exposure Vulnerability

A vulnerability exists in the Jenkins Applitools Eyes Plugin in versions through 1.16.5, where Applitools API keys are stored unencrypted in job configuration files on the Jenkins controller. These keys can be accessed by users with Item/Extended Read permission or those who have access to the Jenkins controller file system. Additionally, the job configuration form does not mask the API keys, raising the risk of unauthorized observation and capture. This vulnerability has been addressed in version 1.16.6 of the plugin.

Impact

The vulnerability allows for unauthorized access to Applitools API keys, which could be misused by an attacker.

Remediation

Users of the Jenkins Applitools Eyes Plugin should update to version 1.16.6, which masks API keys in the configuration form and encrypts them when job configurations are saved.