CVE-2021-21657: XXE vulnerability in Jenkins Filesystem Trigger Plugin
Summary
CVE-2021-21657: XXE vulnerability in Jenkins Filesystem Trigger Plugin. Affects org.jenkins-ci.plugins:fstrigger versions < 0.41. Fixed in 0.41. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Jenkins Filesystem Trigger Plugin is a Maven package (org.jenkins-ci.plugins:fstrigger) that allows users to trigger Jenkins jobs based on changes to files in a specified directory. It provides functionality for monitoring file systems and triggering builds when changes occur. This plugin is widely used in Jenkins environments for automating build processes and continuous integration workflows.
Vulnerability Detail
The Filesystem Trigger Plugin version 0.40 and earlier is vulnerable to an XML External Entity (XXE) attack. This vulnerability arises from the plugin's failure to configure its XML parser to prevent XXE attacks. An attacker with Job/Configure permission or the ability to control the contents of an XML file being polled for changes can exploit this vulnerability. By crafting a malicious XML document, the attacker can trick Jenkins into parsing it and perform actions such as extracting secrets, initiating server-side request forgery, or launching denial-of-service attacks. The impact of this vulnerability can be significant, compromising the security and stability of the Jenkins controller or agent.
How To Fix
Minimum fixed version
0.41
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to Filesystem Trigger Plugin version 0.41 or later.
Conclusion
The XXE vulnerability in Jenkins Filesystem Trigger Plugin can have severe consequences, compromising the security and stability of Jenkins environments. It is crucial to upgrade to Filesystem Trigger Plugin version 0.41 or later to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:fstrigger →
FAQ
This vulnerability allows attackers to exploit the Filesystem Trigger Plugin to perform actions such as extracting secrets, initiating server-side request forgery, or launching denial-of-service attacks. It can compromise the security and stability of the Jenkins controller or agent.
Users of Jenkins Filesystem Trigger Plugin versions 0.40 and earlier are affected by this vulnerability.
No, there is no known workaround for this vulnerability. It is crucial to upgrade to Filesystem Trigger Plugin version 0.41 or later.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
For more information about this vulnerability, you can refer to the CVE-2021-21657 advisory on the Vulert website (https://vulert.com/scanner).
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
