CVE-2021-21646: Remote code execution vulnerability in Jenkins Templating Engine Plugin
Summary
CVE-2021-21646: Remote code execution vulnerability in Jenkins Templating Engine Plugin. Affects org.jenkins-ci.plugins:templating-engine versions < 2.2. Fixed in 2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Jenkins Templating Engine Plugin is a Maven-based package that provides a templating engine for Jenkins pipeline configurations. It allows users to define reusable templates for their pipelines, improving code reusability and maintainability. The plugin integrates with the Script Security Plugin to ensure the security of pipeline configurations. However, versions 2.1 and earlier of the Templating Engine Plugin do not properly protect pipeline configurations, making them vulnerable to remote code execution attacks.
Vulnerability Detail
The vulnerability (CVE-2021-21646) in the Jenkins Templating Engine Plugin allows attackers with Job/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM. This means that an attacker can gain control over the Jenkins server and potentially perform malicious actions. The vulnerability arises from the lack of protection provided by the Script Security Plugin in versions 2.1 and earlier of the Templating Engine Plugin. The issue has a CVSSv3 score of 8.8, indicating a high severity level.
How To Fix
Minimum fixed version
2.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to version 2.2 is not immediately feasible, a workaround is to restrict Job/Configure permission to trusted users only. By limiting access to this permission, the risk of exploitation can be mitigated. However, this is a temporary solution, and upgrading to the latest version is still strongly recommended.
Conclusion
The remote code execution vulnerability in Jenkins Templating Engine Plugin (CVE-2021-21646) poses a significant risk to Jenkins servers running versions 2.1 and earlier of the plugin. To mitigate this vulnerability, it is crucial to upgrade to version 2.2 or later, which integrates with the Script Security Plugin to protect pipeline configurations. Restricting Job/Configure permission to trusted users can provide a temporary workaround, but upgrading to the latest version is strongly recommended. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:templating-engine →
FAQ
This vulnerability allows attackers to execute arbitrary code on the Jenkins server, potentially leading to unauthorized access, data breaches, or disruption of services.
Users of Jenkins Templating Engine Plugin versions 2.1 and earlier are affected by this vulnerability.
At the time of this advisory, there are no known public exploits targeting this vulnerability. However, it is important to patch the vulnerability as soon as possible to prevent any potential exploitation.
A temporary mitigation is to restrict Job/Configure permission to trusted users only. However, this is not a permanent solution, and upgrading to the latest version of the Templating Engine Plugin is strongly recommended.
For more information about this vulnerability, you can refer to the official CVE-2021-21646 advisory or contact the Jenkins community for assistance.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:templating-engine.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
