# Plugin Portal Security CVE-2020-7599

DevFeed: [Plugin Portal Security CVE-2020-7599](<https://devfeed.tech/articles/plugin-portal-security-cve-2020-7599-24678.md>)

Original publisher: [Read original article](<https://blog.gradle.org/plugin-portal-update>)

Author: Sterling Greene

Published: 2020-03-27T04:00:00Z

Content type: article

Language: en

Sources: [The Gradle Blog](<https://devfeed.tech/sources/the-gradle-blog.md>)

Topics: [Gradle](<https://devfeed.tech/topics/gradle.md>), [Security](<https://devfeed.tech/topics/security.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Logging](<https://devfeed.tech/topics/logging.md>), [ci](<https://devfeed.tech/topics/ci.md>), [Publishing](<https://devfeed.tech/topics/publishing.md>)

Tags: [ci](<https://devfeed.tech/tags/ci.md>), [cve](<https://devfeed.tech/tags/cve.md>), [gradle](<https://devfeed.tech/tags/gradle.md>), [logging](<https://devfeed.tech/tags/logging.md>), [maintainers](<https://devfeed.tech/tags/maintainers.md>), [netflix](<https://devfeed.tech/tags/netflix.md>), [plugin](<https://devfeed.tech/tags/plugin.md>), [security](<https://devfeed.tech/tags/security.md>), [travis-ci](<https://devfeed.tech/tags/travis-ci.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

## AI overview

This security update describes CVE-2020-7599 in the Gradle Plugin Publish Plugin. Elevated logging could expose a reusable pre-signed AWS S3 upload URL in build logs, allowing someone with access to the logs to overwrite plugin artifacts on the Plugin Portal. The article recommends upgrading com.gradle.plugin-publish plugin to version 0.11.0, avoiding elevated log levels for sensitive publishing builds, keeping such builds private, and following CI provider practices for protecting build logs.

## Source excerpt

Important update when publishing plugins to the Plugin Portal A security vulnerability was reported to us on March 4th, 2020. This problem could allow an authorized person to overwrite plugin artifacts on the Plugin Portal if they had access to the build logs that published the plugin. After a thorough investigation, we found no artifacts were overwritten for a malicious purpose. In response, we've published a new version of the com.gradle.plugin-publish plugin that contains an update to mitigate this security vulnerability. Please upgrade com.gradle.plugin-publish plugin to version 0.11.0. Old versions of the com.gradle.plugin-publish plugin will no longer work. If you do not publish plugins to the Plugin Portal, you do not need to do anything. We also recommend that builds handling sensitive information (like publishing builds) do not run with elevated log levels (like --debug with Gradle) and are kept private to minimize the damage that can be done if sensitive information is exposed. You should also follow the best practices of your CI provider to avoid leaking sensitive information into build logs (as an example, Travis CI). Like other software, build maintainers and plugin authors need to keep in mind the types of information that may be logged. This post is a summary of what we found and how we verified that artifacts served by the Plugin Portal were not changed. Continue reading if you're interested in what we uncovered. Discovery of the Vulnerability On March 4th, 2020, we were notified about a security vulnerability with uploads to the Plugin Portal. The vulnerability could allow anyone with access to the log file from the build that published the plugins to overwrite the plugin's artifacts when info level logging is enabled. This is an information disclosure vulnerability (CWE-532: Insertion of Sensitive Information into Log File) for the Plugin Publish Plugin and is tracked by CVE-2020-7599. Thanks to Danny Thomas from Netflix for reporting this issue to