CVE-2021-21645: Missing permission checks in Jenkins Config File Provider Plugin allow enumerating configuration file IDs
Summary
CVE-2021-21645: Jenkins Config File Provider Plugin 3.7.0 and earlier does not perform permission checks in several HTTP endpoints. Affects org.jenkins-ci.plugins:config-file-provider versions < 3.7.1. Fixed in 3.7.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Config File Provider Plugin is a Maven package that provides a convenient way to manage configuration files in Jenkins. It allows users to define and manage configuration files that can be used by Jenkins jobs. These configuration files can contain sensitive information such as credentials, API keys, and other configuration settings. The plugin provides an HTTP API for managing these configuration files.
Vulnerability Detail
The Config File Provider Plugin version 3.7.0 and earlier has a vulnerability that allows attackers with Overall/Read permission to enumerate configuration file IDs. This means that an attacker with the appropriate permissions can retrieve a list of all configuration file IDs in the system. This can be a security risk as it exposes sensitive information and can potentially lead to further attacks.
How To Fix
Minimum fixed version
3.7.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of the plugin is not immediately possible, a temporary workaround is to restrict the permissions of users with Overall/Read permission. By limiting the number of users with this permission, the risk of unauthorized enumeration of configuration file IDs can be mitigated. Additionally, it is recommended to regularly review and audit the permissions of users in Jenkins to ensure that only authorized users have access to sensitive information.
Conclusion
The missing permission checks in the Jenkins Config File Provider Plugin can lead to unauthorized enumeration of configuration file IDs, potentially exposing sensitive information. It is crucial to upgrade to the latest version of the plugin (3.7.1 or later) to patch this vulnerability. Additionally, restricting the permissions of users with Overall/Read permission and regularly reviewing user permissions can help mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:config-file-provider →
FAQ
The vulnerability allows attackers to enumerate configuration file IDs, potentially exposing sensitive information and increasing the risk of further attacks.
Users of Config File Provider Plugin versions 3.7.0 and earlier are affected by this vulnerability.
There are no known public exploits for this vulnerability at the time of this report. However, it is important to patch the vulnerability as soon as possible to prevent potential attacks.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins instance is affected by this vulnerability. Simply enter your Jenkins instance URL and the tool will analyze your dependencies and alert you if any vulnerabilities are found.
Yes, the CVSS score for this vulnerability is 4.3, indicating a moderate severity.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:config-file-provider.
