CVE-2021-21617: CSRF vulnerability in Jenkins Configuration Slicing Plugin
Summary
CVE-2021-21617: CSRF vulnerability in Jenkins Configuration Slicing Plugin. Affects org.jenkins-ci.plugins:configurationslicing versions < 1.52. Fixed in 1.52. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Configuration Slicing Plugin is a Maven package (org.jenkins-ci.plugins:configurationslicing) that allows users to configure and manage multiple instances of a job or project in Jenkins. It provides a convenient way to slice and modify configurations for different jobs. However, versions 1.51 and earlier of the plugin have a vulnerability that allows cross-site request forgery (CSRF) attacks.
Vulnerability Detail
The CSRF vulnerability in the Configuration Slicing Plugin allows attackers to exploit the lack of POST request requirement for form submission, enabling them to perform unauthorized actions on the affected Jenkins instance. By tricking a user into visiting a malicious website or clicking on a specially crafted link, an attacker can modify the slice configurations of attacker-specified jobs. This can lead to unauthorized changes in job configurations, potentially compromising the integrity and security of the Jenkins environment.
How To Fix
Minimum fixed version
1.52
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The CSRF vulnerability in the Jenkins Configuration Slicing Plugin (CVE-2021-21617) allows attackers to modify job configurations through unauthorized actions. To mitigate this vulnerability, it is recommended to upgrade to Configuration Slicing Plugin version 1.52 or later. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:configurationslicing →
FAQ
This vulnerability allows attackers to modify the slice configurations of attacker-specified jobs in Jenkins, potentially leading to unauthorized changes in job configurations.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins instance is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this CSRF vulnerability.
At the moment, there are no known workarounds for this vulnerability. It is recommended to upgrade to the latest version of the Configuration Slicing Plugin to mitigate the CSRF vulnerability.
There is no evidence of active exploitation of this vulnerability at the moment. However, it is crucial to apply the necessary security patches and updates to prevent potential attacks.
For more information about this vulnerability, you can refer to the GitHub Security Advisory GHSA-42mm-x828-56c7 (https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-42mm-x828-56c7/GHSA-42mm-x828-56c7.json).
