T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/jenkins_handler.py:15
- Finding
- Jenkins Credentials Are Transmitted over Plaintext HTTP## Vulnerability Details **File Location**: `scripts/jenkins_handler.py:15-18, 33-45, 61-69` **Vulnerability Type**: Cleartext transmission of authentication credentials **Risk Level**: High ### Vulnerable Code ```python JENKINS_URL = os.getenv("JENKINS_URL", "http://jks.huimei-inc.com") USERNAME = os.getenv("JENKINS_USERNAME", "jiaofu") API_TOKEN = os.getenv("JENKINS_API_TOKEN", "") PASSWORD = os.getenv("JENKINS_PASSWORD", "") ``` ```python if try_api_token_first and API_TOKEN: try: test_url = f"{JENKINS_URL}/api/json" response = session.get( test_url, auth=(USERNAME, API_TOKEN), timeout=10 ) if response.status_code == 200: return (USERNAME, API_TOKEN) except Exception: pass if PASSWORD: return (USERNAME, PASSWORD) ``` ```python headers = { "Authorization": f"Basic {base64.b64encode(f'{auth[0]}:{auth[1]}'.encode()).decode()}" } ``` ### Technical Analysis The default Jenkins endpoint uses unencrypted HTTP. The `requests` authentication tuple causes the username and API token or password to be sent using HTTP Basic authentication. Basic authentication only Base64-encodes the credentials; it does not provide encryption. The Base64 operation identified by the pre-scan is used to construct a conventional HTTP Basic Authorization header. There is no evidence that this encoded value is printed or used as a covert output channel. Nevertheless, sending that header over HTTP exposes the underlying credential to anyone capable of observing or manipulating network traffic. The insecure HTTP endpoint is also documented in `SKILL.md`, making insecure deployment the default rather than an exceptional configuration. ### Attack Path 1. A user configures or accepts the default `http://jks.huimei-inc.com` endpoint. 2. The Skill sends a Jenkins API request using a username and API token or pas ...[truncated 1274 chars]
- Remediation
- ## Remediation Suggestions 1. Change the default endpoint to an HTTPS URL with a valid certificate. 2. Reject any configured `JENKINS_URL` that does not use the `https` scheme. 3. Keep TLS certificate verification enabled and do not introduce `verify=False`. 4. Remove all plaintext HTTP Jenkins examples from `SKILL.md`. 5. Use a dedicated, revocable Jenkins API token instead of an account password. 6. Assign the Jenkins service account only the job-read, build-trigger, build-status, and artifact-read permissions required for approved jobs. 7. Restrict the account from administrative actions, credential management, script-console access, and unrelated deployment jobs. 8. Rotate any credential that may already have traversed the plaintext endpoint. 9. Consider pinning the expected Jenkins hostname and applying outbound network controls so credentials cannot be sent to an arbitrary environment-configured host.