CVE-2021-21644: CSRF vulnerability in Jenkins Config File Provider Plugin allows deleting configuration files
Summary
CVE-2021-21644: CSRF vulnerability in Jenkins Config File Provider Plugin allows deleting configuration files. Affects org.jenkins-ci.plugins:config-file-provider versions < 3.7.1. Fixed in 3.7.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Config File Provider Plugin is a Jenkins plugin that allows users to define and manage configuration files for their Jenkins jobs. It provides a centralized way to store and manage configuration files, making it easier to maintain and update job configurations. The plugin integrates with various version control systems and allows users to define configuration files using different formats such as XML, JSON, or properties files. However, versions 3.7.0 and earlier of the plugin have a vulnerability that allows attackers to delete configuration files through a cross-site request forgery (CSRF) attack.
Vulnerability Detail
The vulnerability in the Config File Provider Plugin (versions 3.7.0 and earlier) is due to the plugin not requiring POST requests for an HTTP endpoint. This allows an attacker to perform a CSRF attack by tricking a user with sufficient privileges to visit a malicious website or click on a specially crafted link. The attacker can specify the ID of the configuration file they want to delete, leading to the deletion of the corresponding configuration file. This vulnerability can have serious consequences as it allows an attacker to modify the configuration of Jenkins jobs, potentially leading to unauthorized access, data loss, or disruption of services.
How To Fix
Minimum fixed version
3.7.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to version 3.7.1 is not immediately possible, users can mitigate the vulnerability by implementing CSRF protection at the network level or by using a web application firewall (WAF) to filter out malicious requests. Additionally, users should exercise caution when clicking on links or visiting websites while logged in to Jenkins to minimize the risk of CSRF attacks.
Conclusion
The CSRF vulnerability in the Jenkins Config File Provider Plugin (CVE-2021-21644) allows attackers to delete configuration files, potentially leading to unauthorized access, data loss, or disruption of services. It is crucial to upgrade to version 3.7.1 or later of the plugin to fix this vulnerability. If immediate upgrade is not possible, implementing CSRF protection at the network level or using a web application firewall can mitigate the risk. Stay vigilant and apply necessary security updates to protect your Jenkins installation.
See every vulnerability recorded for org.jenkins-ci.plugins:config-file-provider →
FAQ
This vulnerability allows attackers to delete configuration files in Jenkins, potentially leading to unauthorized access, data loss, or disruption of services.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, and you can check the vulnerability status of your software without requiring access to the code or installation.
If upgrading to the latest version of the Config File Provider Plugin is not immediately possible, you can implement CSRF protection at the network level or use a web application firewall (WAF) to filter out malicious requests.
There is no evidence of active exploits targeting this vulnerability at the moment. However, it is still important to apply the necessary security updates to protect against potential attacks.
For further support or assistance on vulnerability remediation, you can contact info@devnack.com. They can provide guidance and help in addressing the vulnerability in your Jenkins installation.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:config-file-provider.
