# Build fetches jars over HTTP

PortSwigger's TeamCity and Jenkins integration builds resolved Maven dependencies over HTTP without integrity checks, allowing a MITM to inject malicious JARs into build artifacts.

- Payout: $1,000
- Severity: medium
- Program: PortSwigger Web Security
- Credited: jlleitschuh
- Disclosed: 2019-06-10
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/506161
- Library page: https://bugbountylibrary.com/r/h1%3A506161
- Tags: domain:oss impact:integrity impact:rce kind:bounty platform:hackerone sev:medium tech:java technique:chained technique:source-review vuln:misconfiguration

**Target:** Maven build configuration (pom.xml) of Burp TeamCity and Jenkins integration plugins
**Root cause:** pom.xml repositories and artifact uploads use HTTP URLs without checksum/integrity verification, so dependencies and credentials traverse plaintext and can be tampered with in transit.
**Steps:**
1. Clone impacted project (burp-teamcity-integration / burp-jenkins-integration)
2. Edit dilettante.py line 143 to target the repository used in the build
3. Start Dilettante locally
4. Proxy the build's HTTP traffic through Dilettante
5. Execute the build's tests
6. Observe injected payload (cat image) confirming malicious JAR substitution
**How found:** Researcher conducted a 4-month supply-chain audit of the JVM ecosystem, reading pom.xml files across OSS projects and spotting HTTP repository URLs lacking integrity checks.
**Exploitation:** Attacker on-path (MITM) intercepts HTTP dependency fetch during build, swaps the JAR with a malicious one via Dilettante, which then executes during unit/integration tests, compromising produced build artifacts; HTTP artifact upload also leaks credentials in plaintext.
**Escalation:** Compromised build artifacts propagate to downstream developers/production servers even after updating, since malicious JARs persist in released artifacts.
**Insight:** Grep OSS build files (pom.xml, build.gradle, package.json) for `http://` repository/upload URLs — build-time dependency resolution is a high-leverage MITM surface that persists into released artifacts.