GHSA-c5r9-rx53-q3gf BIT-jenkins-2021-21696 CVE-2021-21696
Agent-to-controller access control allowed writing to sensitive directory used by Jenkins Pipeline: Shared Groovy Libraries Plugin
- Severity
- 8.8 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 2.40%
- Chance of exploitation in the next 30 days. Higher than 84.01% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-693 Protection Mechanism Failure
- Fix
2.303.3- Upgrade org.jenkins-ci.main:jenkins-core to this version or later
Description
Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not limit agent read/write access to the libs/ directory inside build directories when using the FilePath APIs. This directory is used by the Pipeline: Shared Groovy Libraries Plugin to store copies of shared libraries.
This allows attackers in control of agent processes to replace the code of a trusted library with a modified variant, resulting in unsandboxed code execution in the Jenkins controller process.
Jenkins 2.319, LTS 2.303.3 prohibits agent read/write access to the libs/ directory inside build directories.
If you are unable to immediately upgrade to Jenkins 2.319, LTS 2.303.3, you can install the Remoting Security Workaround Plugin. It will prevent all agent-to-controller file access using FilePath APIs. Because it is more restrictive than Jenkins 2.319, LTS 2.303.3, more plugins are incompatible with it. Make sure to read the plugin documentation before installing it.
It is not easily possible to customize the file access rules to prohibit access to the libs/ directory specifically, as built-in rules (granting access to <BUILDDIR> contents) would take precedence over a custom rule prohibiting access.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| org.jenkins-ci.main:jenkins-core | < 2.303.3 |
2.303.3 |
| org.jenkins-ci.main:jenkins-core | >= 2.304, < 2.319 |
2.319 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
org.jenkins-ci.main:jenkins-core Maven → 2.303.3
- maven
<dependency><groupId>org.jenkins-ci.main</groupId><artifactId>jenkins-core</artifactId><version>2.303.3</version></dependency>- gradle
implementation("org.jenkins-ci.main:jenkins-core:2.303.3")
Severity breakdown
CVSS 3.1 8.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-693: Protection Mechanism Failure
The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-6f9g-cxwr-q5jr Arbitrary file read vulnerability through the Jenkins CLI can lead to RCE | Critical Known exploited | Also affects org.jenkins-ci.main:jenkins-core |
| GHSA-8pqx-3rxx-f5pm Jenkins discloses project names via fingerprints | High Known exploited | Also affects org.jenkins-ci.main:jenkins-core |
| GHSA-26wc-3wqp-g3rp Deserialization of Untrusted Data in Jenkins | Critical Known exploited | Also affects org.jenkins-ci.main:jenkins-core |
| CVE-2018-1000861 Deserialization of Untrusted Data in Jenkins | Critical Known exploited | Also affects org.jenkins-ci.main:jenkins-core |
| GHSA-m6wv-wh8g-64xc Jenkins does not encrypt secrets from POST config.xml submissions before storing them in job configurations | Medium | Also affects org.jenkins-ci.main:jenkins-core |
| GHSA-93qh-vwrm-c5pw Jenkins: Stored XSS vulnerability in node offline cause description | Medium | Also affects org.jenkins-ci.main:jenkins-core |
| GHSA-92m7-4fpw-2wxm Jenkins: Open Redirect phishing attacks possible via "from" parameter in "Delegate to servlet container" | Medium | Also affects org.jenkins-ci.main:jenkins-core |
| GHSA-g28p-6mcc-v4rv Jenkins exposes other users' timezone and view names to users with Overall/Read permission | Medium | Also affects org.jenkins-ci.main:jenkins-core |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor