Jenkins Build Authorization Token Storage Vulnerability

A vulnerability exists in Jenkins versions through 2.540 and LTS versions through 2.528.2, where build authorization tokens are stored unencrypted in job config.xml files on the Jenkins controller. This exposure allows users with Item/Extended Read permission or access to the Jenkins controller file system to view these tokens. Additionally, the job configuration form does not mask these tokens, further increasing the risk of unauthorized observation and capture.

Impact

The unencrypted storage of build authorization tokens in job config.xml files on the Jenkins controller creates a risk of unauthorized access to these tokens by users with the appropriate permissions or file system access.

Remediation

Users can update to Jenkins version 2.541 or LTS version 2.528.3, both of which encrypt the build authorization tokens and mask them in the job configuration form. After updating, all affected job configurations can be migrated to the new encrypted format by navigating to 'Manage Jenkins' > 'Manage Old Data' and selecting 'Upgrade' in the 'Old Data Format' section.