Details
-
Bug
-
Status: Closed (View Workflow)
-
Critical
-
Resolution: Fixed
Description
The Slack plugin reveals the integration token in the global configuration. In environments when many people have access to view the global configuration, this presents a security vulnerability since the token appears to give access to quite a bit of the Slack instance (though it's not entirely clear where that's configured).
Attachments
Issue Links
- links to
Activity
Dominic Hargreaves
created issue -
Dominic Hargreaves
made changes -
| Field | Original Value | New Value |
|---|---|---|
| Description | The Slack plugin reveals the integration token in the global configuration. In environments when many people have access to view the global configuration, this presents a security vulnerability since the token gives access to the | The Slack plugin reveals the integration token in the global configuration. In environments when many people have access to view the global configuration, this presents a security vulnerability since the token appears to give access to quite a bit of the Slack instance (though it's not entirely clear where that's configured). |
| Workflow | JNJira [ 171807 ] | JNJira + In-Review [ 184485 ] |
| Labels | security |
| Priority | Minor [ 4 ] | Critical [ 2 ] |
Kurt Madel
added a comment - There is a PR to integrate with credentials but still a bit of work to do.
Kurt Madel
added a comment - There is a PR to integrate with credentials but still a bit of work to do. Kurt Madel
added a comment - One more note, in regards to the Pipeline step - you may use the
withCredentials
wrapper - see https://jenkins.io/doc/pipeline/steps/credentials-binding/#withcredentials-bind-credentials-to-variables
Kurt Madel
added a comment - One more note, in regards to the Pipeline step - you may use the
withCredentials
wrapper - see https://jenkins.io/doc/pipeline/steps/credentials-binding/#withcredentials-bind-credentials-to-variables Do not use withCredentials for this purpose as the argument will temporarily be in plaintext, which could lead to vulnerabilities depending on circumstances.
Kurt Madel
added a comment - See https://github.com/jenkinsci/slack-plugin/pull/247 for initial fix. Still allows users to expose auth token but provides highly visible warning.
Kurt Madel
added a comment - See https://github.com/jenkinsci/slack-plugin/pull/247 for initial fix. Still allows users to expose auth token but provides highly visible warning. Code changed in jenkins
User: Kurt Madel
Path:
README.md
pom.xml
src/main/java/jenkins/plugins/slack/SlackNotifier.java
src/main/java/jenkins/plugins/slack/StandardSlackService.java
src/main/java/jenkins/plugins/slack/workflow/SlackSendStep.java
src/main/resources/jenkins/plugins/slack/SlackNotifier/config.jelly
src/main/resources/jenkins/plugins/slack/SlackNotifier/global.jelly
src/main/resources/jenkins/plugins/slack/workflow/SlackSendStep/config.jelly
src/main/resources/jenkins/plugins/slack/workflow/SlackSendStep/help-tokenCredentialId.html
src/main/webapp/help-globalConfig-tokenCredentialId.html
src/main/webapp/help-projectConfig-slackTokenCredentialId.html
src/test/java/jenkins/plugins/slack/SlackNotifierStub.java
src/test/java/jenkins/plugins/slack/SlackNotifierTest.java
src/test/java/jenkins/plugins/slack/StandardSlackServiceStub.java
src/test/java/jenkins/plugins/slack/StandardSlackServiceTest.java
src/test/java/jenkins/plugins/slack/workflow/SlackSendStepIntegrationTest.java
src/test/java/jenkins/plugins/slack/workflow/SlackSendStepTest.java
http://jenkins-ci.org/commit/slack-plugin/40a0ac49e279fb2956f349143725023baaf10cca
Log:
Merge pull request #247 from kmadel/pr-208
Add Credentials Support with credentials select widget JENKINS-35503
Compare: https://github.com/jenkinsci/slack-plugin/compare/e568a98e4fbe...40a0ac49e279
Kurt Madel
added a comment - slack 2.1 Kurt Madel
made changes -
| Resolution | Fixed [ 1 ] | |
| Status | Open [ 1 ] | Resolved [ 5 ] |
Kurt Madel
made changes -
| Status | Resolved [ 5 ] | Closed [ 6 ] |
| Remote Link | This issue links to "CloudBees Internal OSS-1367 (Web Link)" [ 18727 ] |
SlackNotifier.DescriptorImpl.token, SlackNotifier.authToken, and SlackSendStep.token store what appears to be an authentication token in plaintext. This is a serious bug.
The short fix is to change SlackNotifier.DescriptorImpl.token to use Secret and f:password, delete SlackSendStep.token (without
JENKINS-27386there is no safe way to use it), and preferably delete SlackNotifier.authToken as well.The better fix is to update the plugin to use the credentials API and thus store only String credentialsId (cf. JENKINS-27398 for the case of SlackSendStep).