CVE-2021-21647: Missing permission check in CloudBees CD Plugin allows scheduling builds
Summary
CVE-2021-21647: Missing permission check in Jenkins CloudBees CD Plugin allows scheduling builds. Affects org.jenkins-ci.plugins:electricflow across 2 version ranges.
< 1.1.18.1
>= 1.1.19, < 1.1.22
Fixed in 1.1.18.1 or 1.1.22, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The CloudBees CD Plugin is an open-source plugin for Jenkins, a popular automation server. It provides integration with CloudBees CD, a release orchestration and deployment automation platform. The plugin allows users to schedule builds of projects in CloudBees CD directly from Jenkins. It is widely used in software development and CI/CD pipelines.
Vulnerability Detail
The CloudBees CD Plugin has a vulnerability that allows attackers with Item/Read permission to schedule builds of projects without having Item/Build permission. This means that an attacker with read access to a project can trigger builds of that project without the necessary permissions. This can lead to unauthorized execution of builds and potential disruption of the CI/CD process. The vulnerability exists in the plugin's HTTP endpoint, which does not perform a permission check before scheduling builds.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.1.18.11.1.18.1 -
>= 1.1.19, < 1.1.221.1.22
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, users can restrict access to the HTTP endpoint of the CloudBees CD Plugin. This can be done by configuring access controls at the network level or by using a reverse proxy to filter and restrict incoming requests to the endpoint. By limiting access to the endpoint, the risk of unauthorized scheduling of builds can be mitigated.
Conclusion
The CloudBees CD Plugin has a vulnerability that allows attackers with read access to schedule builds without the necessary permissions. This can lead to unauthorized execution of builds and potential disruption of the CI/CD process. It is recommended to update the plugin to version 1.1.18.1 or later to fix the vulnerability. In the meantime, restricting access to the plugin's HTTP endpoint can serve as a workaround. For more information and support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:electricflow →
FAQ
The vulnerability allows attackers with read access to schedule builds of projects without the necessary permissions. This can lead to unauthorized execution of builds and potential disruption of the CI/CD process.
Users of the CloudBees CD Plugin versions 0.0.0 to 1.1.18 and versions 1.1.19 to 1.1.22 are affected by this vulnerability.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply enter your pom.xml file and the playground will analyze it for open-source vulnerabilities, including this one.
There are no known exploits for this vulnerability at the time of this report. However, it is recommended to apply the fix or workaround as soon as possible to prevent potential exploitation.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide guidance and assistance in addressing this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:electricflow.
