[JENKINS-62336] Credentials binding plugin doubling $ characters inside secrets

Hello,

we (believe it's that plugin) are having an issue with Credentials Binding plugin version 1.23 (and 1.21).

The issue:  When you have a dollar sign character "$" as part of your secret inside Jenkins credentials (credential type: secret text), it will actually be converted to double the amount of $ signs. So if your secret is e.g. 123$, it will be converted to 123$$

We started noticing this issue with Credentials Binding plugin version 1.21 so we upgraded to 1.23 hoping it would be fixed, based on this (read "SECURITY-1835 / CVE-2020-2182")

https://www.jenkins.io/security/advisory/2018-02-05/#credentials-binding

Turns out upgrading the plugin only fixes the exposed secret in the logs (another issue we had), but does not fix doubling the $ sign.

Steps to reproduce:

1. Add a credential to Jenkins of type "secret text", having the password contain a dollar sign $.

2. Use the credentials in your plugin and perhaps save it into the file, archive it and read it later to see what the passed credentials is, for us it doubles the $ sign.

We noticed it in a .yaml file when we used Helm so I'm pasting a portion of that, exactly how we use it. This pipeline below produces a "testrail-template.yaml" and I can read it from Jenkins UI, the password passed in there contains doubled dollar sign character.

#!/usr/bin/env groovy


@​Library('tools') _

def rdsCredentialsId =  'testrail-test6' 

pipeline {

  agent { label "aws-agent" }

  stages {

      

    stage('test') {

environment {

DB_PASSWORD = credentials("${rdsCredentialsId}")

      }

      steps {

  container('jenkins-k8s'){

  script{

sh '''

helmcustom="helm template -f ./testrail/values-staging.yaml \

--set secret.db.password='${DB_PASSWORD}'"

bash -c "$helmcustom testrail > testrail-template.yaml"

'''

archiveArtifacts 'testrail-template.yaml'

  }

}

      }

    }

  }

}

 

Let me know if you have any questions!

Thanks!

Marcin

 

---
Originally reported by kwic, imported from: Credentials binding plugin doubling $ characters inside secrets

• status: Open
  
• priority: Minor
  
• component(s): credentials-binding-plugin
  
• resolution: Unresolved
  
• votes: 1
  
• watchers: 3
  
• imported: 20251211-141027
  

Raw content of original issue

Hello,


we (believe it's that plugin) are having an issue with Credentials Binding plugin version 1.23 (and 1.21).


The issue:  When you have a dollar sign character "$" as part of your secret inside Jenkins credentials (credential type: secret text), it will actually be converted to double the amount of $ signs. So if your secret is e.g. 123$, it will be converted to 123$$


We started noticing this issue with Credentials Binding plugin version 1.21 so we upgraded to 1.23 hoping it would be fixed, based on this (read "SECURITY-1835 / CVE-2020-2182")

https://www.jenkins.io/security/advisory/2018-02-05/#credentials-binding


Turns out upgrading the plugin only fixes the exposed secret in the logs (another issue we had), but does not fix doubling the $ sign.


Steps to reproduce:

1. Add a credential to Jenkins of type "secret text", having the password contain a dollar sign $.

2. Use the credentials in your plugin and perhaps save it into the file, archive it and read it later to see what the passed credentials is, for us it doubles the $ sign.


We noticed it in a .yaml file when we used Helm so I'm pasting a portion of that, exactly how we use it. This pipeline below produces a "testrail-template.yaml" and I can read it from Jenkins UI, the password passed in there contains doubled dollar sign character.




#!/usr/bin/env groovy


@Library('tools') _

def rdsCredentialsId =  'testrail-test6' 

pipeline {

  agent { label "aws-agent" }

  stages {

      

    stage('test') {

        environment {

        DB_PASSWORD = credentials("${rdsCredentialsId}")

      }

      steps {

          container('jenkins-k8s'){

          script{

                sh '''

                helmcustom="helm template -f ./testrail/values-staging.yaml \

                --set secret.db.password='${DB_PASSWORD}'"

                

                bash -c "$helmcustom testrail > testrail-template.yaml"

                '''

                archiveArtifacts 'testrail-template.yaml'

                

          }

        }

      }

    }

  }

}





 


Let me know if you have any questions!

Thanks!

Marcin


 

environment

```
awt.toolkit sun.awt.X11.XToolkit

BLUEOCEAN_FEATURE_AUTOFAVORITE_ENABLED false

casc.reload.token jenkins-server-6db445df48-vp47d

executable-war /usr/share/jenkins/jenkins.war

file.encoding UTF-8

file.encoding.pkg sun.io

file.separator /

io.jenkins.plugins.casc.ConfigurationAsCode.initialDelay 9000

io.jenkins.plugins.kubernetes.disableNoDelayProvisioning true

java.awt.graphicsenv sun.awt.X11GraphicsEnvironment

java.awt.headless true

java.awt.printerjob sun.print.PSPrinterJob

java.class.path /usr/share/jenkins/jenkins.war

java.class.version 52.0

java.endorsed.dirs /usr/local/openjdk-8/jre/lib/endorsed

java.ext.dirs /usr/local/openjdk-8/jre/lib/ext:/usr/java/packages/lib/ext

java.home /usr/local/openjdk-8/jre

java.io.tmpdir /tmp

java.library.path /usr/java/packages/lib/amd64:/usr/lib64:/lib64:/lib:/usr/lib

java.runtime.name OpenJDK Runtime Environment

java.runtime.version 1.8.0_242-b08

java.specification.name Java Platform API Specification

java.specification.vendor Oracle Corporation

java.specification.version 1.8

java.vendor Oracle Corporation

java.vendor.url http://java.oracle.com/

java.vendor.url.bug http://bugreport.sun.com/bugreport/

java.version 1.8.0_242

java.vm.info mixed mode

java.vm.name OpenJDK 64-Bit Server VM

java.vm.specification.name Java Virtual Machine Specification

java.vm.specification.vendor Oracle Corporation

java.vm.specification.version 1.8

java.vm.vendor Oracle Corporation

java.vm.version 25.242-b08

jenkins.install.runSetupWizard false

jenkins.model.Jenkins.slaveAgentPort 31404

jenkins.security.ApiTokenProperty.showTokenToAdmins true

jetty.git.hash e1bc35120a6617ee3df052294e433f3a25ce7097

jna.loaded true

jna.platform.library.path /usr/lib/x86_64-linux-gnu:/lib/x86_64-linux-gnu:/lib64:/usr/lib:/lib:/usr/local/openjdk-8/lib/amd64/jli:/usr/local/openjdk-8/lib/amd64

jnidispatch.path /var/jenkins_home/.cache/JNA/temp/jna4304027752009182614.tmp

kubernetes.websocket.ping.interval 10000

kubernetes.websocket.timeout 5000

line.separator

mail.smtp.sendpartial true

mail.smtps.sendpartial true

os.arch amd64

os.name Linux

os.version 4.14.171-136.231.amzn2.x86_64

path.separator :

sun.arch.data.model 64

sun.boot.class.path /usr/local/openjdk-8/jre/lib/resources.jar:/usr/local/openjdk-8/jre/lib/rt.jar:/usr/local/openjdk-8/jre/lib/sunrsasign.jar:/usr/local/openjdk-8/jre/lib/jsse.jar:/usr/local/openjdk-8/jre/lib/jce.jar:/usr/local/openjdk-8/jre/lib/charsets.jar:/usr/local/openjdk-8/jre/lib/jfr.jar:/usr/local/openjdk-8/jre/classes

sun.boot.library.path /usr/local/openjdk-8/jre/lib/amd64

sun.cpu.endian little

sun.cpu.isalist

sun.font.fontmanager sun.awt.X11FontManager

sun.io.unicode.encoding UnicodeLittle

sun.java.command /usr/share/jenkins/jenkins.war --argumentsRealm.passwd.admin>=$$&W116c0ioyD

--argumentsRealm.roles.admin>=admin --httpPort=8080

sun.java.launcher SUN_STANDARD

sun.jnu.encoding UTF-8

sun.management.compiler HotSpot 64-Bit Tiered Compilers

sun.os.patch.level unknown

user.dir /

user.home /var/jenkins_home

user.language en

user.name jenkins

user.timezone Etc/UTC

Environment Variables

Name ↓

Value

ADMIN_PASSWORD $$&W116c0ioyD

ADMIN_USER admin

AWS_ROLE_ARN arn:aws:iam::136813947591:role/test-nahuel-s3-jenkins

AWS_WEB_IDENTITY_TOKEN_FILE /var/run/secrets/eks.amazonaws.com/serviceaccount/token

CASC_JENKINS_CONFIG /var/jenkins_home/casc_configs

COPY_REFERENCE_FILE_LOG /var/jenkins_home/copy_reference_file.log

HOME /var/jenkins_home

HOSTNAME jenkins-server-6db445df48-vp47d

JAVA_BASE_URL https://github.com/AdoptOpenJDK/openjdk8-upstream-binaries/releases/download/jdk8u242-b08/OpenJDK8U-jdk_

JAVA_HOME /usr/local/openjdk-8

JAVA_OPTS -Dcasc.reload.token=jenkins-server-6db445df48-vp47d -Djenkins.install.runSetupWizard=false -Dkubernetes.websocket.ping.interval=10000 -Dkubernetes.websocket.timeout=5000 -Dio.jenkins.plugins.kubernetes.disableNoDelayProvisioning=true -Dio.jenkins.plugins.casc.ConfigurationAsCode.initialDelay=9000 -Djenkins.security.ApiTokenProperty.showTokenToAdmins=true -DBLUEOCEAN_FEATURE_AUTOFAVORITE_ENABLED=false -Xmx14g

JAVA_URL_VERSION 8u242b08

JAVA_VERSION 8u242

JENKINS_AGENTS_PORT tcp://172.20.228.30:31404

JENKINS_AGENTS_PORT_31404_TCP tcp://172.20.228.30:31404

JENKINS_AGENTS_PORT_31404_TCP_ADDR 172.20.228.30

JENKINS_AGENTS_PORT_31404_TCP_PORT 31404

JENKINS_AGENTS_PORT_31404_TCP_PROTO tcp

JENKINS_AGENTS_SERVICE_HOST 172.20.228.30

JENKINS_AGENTS_SERVICE_PORT 31404

JENKINS_HOME /var/jenkins_home

JENKINS_INCREMENTALS_REPO_MIRROR https://repo.jenkins-ci.org/incrementals

JENKINS_OPTS

JENKINS_SLAVE_AGENT_PORT 31404

JENKINS_UC https://updates.jenkins.io

JENKINS_UC_EXPERIMENTAL https://updates.jenkins.io/experimental

JENKINS_VERSION 2.204.2

JENKINS_WEB_PORT tcp://172.20.244.85:8080

JENKINS_WEB_PORT_8080_TCP tcp://172.20.244.85:8080

JENKINS_WEB_PORT_8080_TCP_ADDR 172.20.244.85

JENKINS_WEB_PORT_8080_TCP_PORT 8080

JENKINS_WEB_PORT_8080_TCP_PROTO tcp

JENKINS_WEB_SERVICE_HOST 172.20.244.85

JENKINS_WEB_SERVICE_PORT 8080

KUBERNETES_PORT tcp://172.20.0.1:443

KUBERNETES_PORT_443_TCP tcp://172.20.0.1:443

KUBERNETES_PORT_443_TCP_ADDR 172.20.0.1

KUBERNETES_PORT_443_TCP_PORT 443

KUBERNETES_PORT_443_TCP_PROTO tcp

KUBERNETES_SERVICE_HOST 172.20.0.1

KUBERNETES_SERVICE_PORT 443

KUBERNETES_SERVICE_PORT_HTTPS 443

LANG C.UTF-8

PATH /usr/local/openjdk-8/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

POD_NAME jenkins-server-6db445df48-vp47d

PWD /

REF /usr/share/jenkins/ref

SHLVL 0

Plugins

Name ↓

Version

Enabled

ace-editor 1.1 true

active-directory 2.16 true

amazon-ecr 1.6 true

amazon-ecs 1.22 true

anka-build 1.22.4 true

ant 1.11 true

antisamy-markup-formatter 1.8 true

apache-httpcomponents-client-4-api 4.5.10-2.0 true

artifactory 3.5.0 true

authentication-tokens 1.3 true

authorize-project 1.3.0 true

aws-credentials 1.28 true

aws-java-sdk 1.11.723 true

azure-commons 1.0.4 true

basic-branch-build-strategies 1.3.2 true

bitbucket 1.1.11 true

blueocean 1.22.0 true

blueocean-autofavorite 1.2.4 true

blueocean-bitbucket-pipeline 1.22.0 true

blueocean-commons 1.22.0 true

blueocean-config 1.22.0 true

blueocean-core-js 1.22.0 true

blueocean-dashboard 1.22.0 true

blueocean-display-url 2.3.1 true

blueocean-events 1.22.0 true

blueocean-executor-info 1.22.0 true

blueocean-git-pipeline 1.22.0 true

blueocean-github-pipeline 1.22.0 true

blueocean-i18n 1.22.0 true

blueocean-jira 1.22.0 true

blueocean-jwt 1.22.0 true

blueocean-personalization 1.22.0 true

blueocean-pipeline-api-impl 1.22.0 true

blueocean-pipeline-editor 1.22.0 true

blueocean-pipeline-scm-api 1.22.0 true

blueocean-rest 1.22.0 true

blueocean-rest-impl 1.22.0 true

blueocean-web 1.22.0 true

bouncycastle-api 2.18 true

branch-api 2.5.5 true

build-monitor-plugin 1.12+build.201809061734 true

build-pipeline-plugin 1.5.8 true

build-timeout 1.19.1 true

build-user-vars-plugin 1.5 true

built-on-column 1.1 true

cloudbees-bitbucket-branch-source 2.7.0 true

cloudbees-folder 6.11.1 true

code-coverage-api 1.1.5 true

command-launcher 1.4 true

conditional-buildstep 1.3.6 true

config-file-provider 3.6.3 true

configuration-as-code 1.36 true

configuration-as-code-secret-ssm 1.0.1 true

configuration-as-code-support 1.18 true

copyartifact 1.43 true

credentials 2.3.7 true

credentials-binding 1.23 true

dependency-track 2.2.1 true

display-url-api 2.3.2 true

docker-commons 1.16 true

docker-java-api 3.0.14 true

docker-plugin 1.1.9 true

docker-workflow 1.22 true

durable-task 1.33 true

email-ext 2.69 true

embeddable-build-status 2.0.3 true

envinject 2.3.0 true

envinject-api 1.7 true

external-monitor-job 1.7 true

favorite 2.3.2 true

git 4.2.0 true

git-client 3.2.0 true

git-parameter 0.9.12 true

git-server 1.9 true

github 1.29.5 true

github-api 1.106 true

github-branch-source 2.6.0 true

google-oauth-plugin 1.0.0 true

gradle 1.36 true

greenballs 1.15 true

handlebars 1.1.1 true

handy-uri-templates-2-api 2.1.8-1.0 true

htmlpublisher 1.22 true

ivy 2.1 true

jackson2-api 2.10.2 true

jacoco 3.0.5 true

javadoc 1.5 true

jaxb 2.3.0 true

jdk-tool 1.4 true

jenkins-design-language 1.22.0 true

jenkins-multijob-plugin 1.32 true

jira 3.0.12 true

jira-steps 1.5.3 true

jquery 1.12.4-1 true

jquery-detached 1.2.1 true

jquery-ui 1.0.2 true

jsch 0.1.55.2 true

junit 1.28 true

kubernetes 1.24.1 true

kubernetes-cd 2.3.0 true

kubernetes-client-api 4.8.0-1 true

kubernetes-credentials 0.6.2 true

ldap 1.21 true

lockable-resources 2.7 true

mailer 1.30 true

matrix-auth 2.5 true

matrix-project 1.14 true

maven-plugin 3.4 true

mercurial 2.8 true

metrics 4.0.2.6 true

momentjs 1.1.1 true

oauth-credentials 0.4 true

pam-auth 1.6 true

parameterized-trigger 2.36 true

pipeline-aws 1.39 true

pipeline-build-step 2.11 true

pipeline-graph-analysis 1.10 true

pipeline-input-step 2.11 true

pipeline-milestone-step 1.3.1 true

pipeline-model-api 1.5.1 true

pipeline-model-declarative-agent 1.1.1 true

pipeline-model-definition 1.5.1 true

pipeline-model-extensions 1.5.1 true

pipeline-rest-api 2.13 true

pipeline-stage-step 2.3 true

pipeline-stage-tags-metadata 1.5.1 true

pipeline-stage-view 2.13 true

pipeline-utility-steps 2.5.0 true

plain-credentials 1.7 true

prometheus 2.0.6 true

pubsub-light 1.13 true

resource-disposer 0.14 true

role-strategy 2.16 true

run-condition 1.2 true

scm-api 2.6.3 true

script-security 1.70 true

slack 2.36 true

sonar 2.11 true

sse-gateway 1.22 true

ssh-agent 1.19 true

ssh-credentials 1.18.1 true

ssh-slaves 1.31.1 true

structs 1.20 true

swarm 3.18 true

timestamper 1.11 true

token-macro 2.11 true

trilead-api 1.0.5 true

variant 1.3 true

webhook-step 1.4 true

windows-slaves 1.6 true

workflow-aggregator 2.6 true

workflow-api 2.40 true

workflow-basic-steps 2.19 true

workflow-cps 2.80 true

workflow-cps-global-lib 2.15 true

workflow-durable-task-step 2.35 true

workflow-job 2.36 true

workflow-multibranch 2.21 true

workflow-scm-step 2.10 true

workflow-step-api 2.22 true

workflow-support 3.4 true

ws-cleanup 0.38 true
```