CVE-2021-21621: User Session ID Exposure in Jenkins Support Core Plugin
Summary
CVE-2021-21621: Support bundles can include user session IDs in Jenkins Support Core Plugin. Affects org.jenkins-ci.plugins:support-core versions < 2.72.1. Fixed in 2.72.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Support Core Plugin is an essential component of the Jenkins automation server, providing various diagnostic and troubleshooting features. It allows users to generate support bundles containing system information, logs, and configuration details for analysis and issue resolution. The plugin is widely used in Jenkins installations to facilitate support and maintenance tasks.
Vulnerability Detail
The Support Core Plugin version 2.72 and earlier includes the serialized user authentication, including session IDs, in the 'About user (basic authentication details only)' information included in the support bundle. This information can be accessed by attackers who have access to the support bundle content and the Jenkins instance. By obtaining the session ID, an attacker could potentially impersonate the user who created the support bundle, leading to unauthorized access and potential misuse of the Jenkins system. The vulnerability has been assigned a CVSS score of 3.1, indicating a low severity level.
How To Fix
Minimum fixed version
2.72.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can deselect the 'About user (basic authentication details only)' option before creating a support bundle. This will exclude the affected information from the bundle and prevent session ID exposure. However, this workaround should be considered temporary, and upgrading to the fixed version is the recommended long-term solution.
Conclusion
The Jenkins Support Core Plugin versions 2.72 and earlier are vulnerable to session ID exposure in support bundles. This vulnerability can be mitigated by upgrading to version 2.72.1 or later, which no longer includes the serialized user authentication. Alternatively, users can apply the temporary workaround of deselecting the 'About user (basic authentication details only)' option. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:support-core →
FAQ
The Jenkins Support Core Plugin is a crucial component of the Jenkins automation server, providing diagnostic and troubleshooting capabilities. It allows users to generate support bundles containing system information, logs, and configuration details for analysis and issue resolution.
This vulnerability exposes user session IDs in support bundles, potentially allowing attackers to impersonate users and gain unauthorized access to the Jenkins system. It is important to upgrade to the fixed version or apply the recommended workaround to mitigate this risk.
The CVSS score of this vulnerability is 3.1, indicating a low severity level. While the impact may not be severe, it is still important to address the vulnerability to prevent potential misuse of the Jenkins system.
To fix this vulnerability, upgrade the Support Core Plugin to version 2.72.1 or later. This version no longer includes the serialized user authentication in the 'About user (basic authentication details only)' information. Upgrading will prevent session ID exposure in support bundles.
Yes, as a temporary workaround, users can deselect the 'About user (basic authentication details only)' option before creating a support bundle. This will exclude the affected information, including session IDs, from the bundle. However, upgrading to the fixed version is still recommended for long-term security.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:support-core.
