CVE-2021-21637: Jenkins Team Foundation Server Plugin - Missing Permission Check
Summary
CVE-2021-21637: Missing permission check in Jenkins Team Foundation Server Plugin allow capturing credentials. Affects org.jenkins-ci.plugins:tfs versions < 5.157.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Team Foundation Server Plugin is a Maven package (org.jenkins-ci.plugins:tfs) that enables integration between Jenkins and Microsoft Team Foundation Server. It allows users to connect to a specified URL using credentials stored in Jenkins. This plugin is widely used in software development environments to automate build, test, and deployment processes.
Vulnerability Detail
The Jenkins Team Foundation Server Plugin version 5.157.1 and earlier suffer from a missing permission check vulnerability (CVE-2021-21637). This vulnerability allows attackers with Overall/Read permission to connect to a URL of their choice using credentials IDs obtained through another method. By exploiting this vulnerability, an attacker can capture credentials stored in Jenkins, potentially leading to unauthorized access and data breaches.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can restrict the Overall/Read permission to trusted individuals only. This can be done by modifying the Jenkins configuration and limiting the access rights of users with Overall/Read permission. However, this workaround may limit the functionality of the plugin and is not a permanent solution.
Conclusion
The Jenkins Team Foundation Server Plugin version 5.157.1 and earlier are vulnerable to a missing permission check, allowing attackers with Overall/Read permission to capture credentials stored in Jenkins. To mitigate this vulnerability, it is recommended to upgrade to version 5.157.2 or later. Restricting the Overall/Read permission can serve as a temporary workaround, but upgrading the plugin is the best long-term solution. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:tfs →
FAQ
This vulnerability allows attackers with Overall/Read permission to capture credentials stored in Jenkins, potentially leading to unauthorized access and data breaches.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins installation is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time.
While there is no known public exploit for this vulnerability at the time of this report, it is crucial to apply the recommended fix or upgrade to the latest version of the Jenkins Team Foundation Server Plugin to mitigate the risk.
As a temporary workaround, you can restrict the Overall/Read permission to trusted individuals only. However, this is not a permanent solution, and it is strongly advised to upgrade the plugin to the latest version.
For more information about this vulnerability, you can refer to the GitHub Security Advisory GHSA-6364-jx4h-7564 (https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-6364-jx4h-7564/GHSA-6364-jx4h-7564.json).
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:tfs.
