CVE-2014-2061 (Java, published 2014-10-17T15:55Z)
Description: value: The input control in PasswordParameterDefinition in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to obtain passwords by reading the HTML source code, related to the default value.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-310 \u2014 Cryptographic Issues
Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.
Repository: https://github.com/jenkinsci/jenkins
Files changed:
core/src/main/java/hudson/Functions.java
core/src/main/java/hudson/model/PasswordParameterDefinition.java
core/src/main/resources/hudson/model/PasswordParameterDefinition/config.jelly
test/src/test/java/hudson/model/PasswordParameterDefinitionTest.java
Commit message: [FIXED SECURITY-93] PasswordParameterDefinition should serve existing default value in encrypted form.
And strengthen functional tests (using configRoundTrip) to ensure that the same mistake is not made elsewhere.


Vulnerable code:
		<f:password name="parameter.defaultValue" value="${instance.defaultValue}" />

Fixed code:
        if (getIsUnitTest()) {
            throw new SecurityException("attempted to render plaintext ‘" + o + "’ in password field; use a getter of type Secret instead");
        }
import org.kohsuke.accmod.Restricted;
import org.kohsuke.accmod.restrictions.DoNotUse;
    @Restricted(DoNotUse.class) // used from Jelly
    public Secret getDefaultValueAsSecret() {
        return defaultValue;
    }

		<f:password name="parameter.defaultValue" value="${instance.defaultValueAsSecret}" />
/*
 * The MIT License
 *
 * Copyright 2013 Jesse Glick.
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
 * in the Software without restriction, including without limitation the rights
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 * copies of the Software, and to permit persons to whom the Software is
 * furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included in
 * all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 * THE SOFTWARE.
 */

package hudson.model;

import static org.junit.Assert.assertEquals;
import org.junit.Rule;
import org.junit.Test;
import org.jvnet.hudson.test.JenkinsRule;

public class PasswordParameterDefinitionTest {

    @Rule public JenkinsRule j = new JenkinsRule();

    @Test public void defaultValueKeptSecret() throws Exception {
        FreeStyleProject p = j.createFreeStyleProject();
        p.addProperty(new ParametersDefinitionProperty(new PasswordParameterDefinition("p", "s3cr3t", "")));
        j.configRoundtrip(p);
        assertEquals("s3cr3t", ((PasswordParameterDefinition) p.getProperty(ParametersDefinitionProperty.class).getParameterDefinition("p")).getDefaultValue());
    }

}