CVE-2021-21661: Missing Authorization in Jenkins Kubernetes CLI Plugin
Summary
CVE-2021-21661: Missing Authorization in Jenkins Kubernetes CLI Plugin. Affects org.jenkins-ci.plugins:kubernetes-cli versions < 1.10.1. Fixed in 1.10.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Kubernetes CLI Plugin is a Maven-based plugin that allows users to interact with Kubernetes clusters from within Jenkins. It provides a command-line interface (CLI) for managing Kubernetes resources and executing commands on Kubernetes clusters. The plugin integrates with Jenkins to enable seamless deployment and management of applications on Kubernetes. However, versions 1.10.0 and earlier of the plugin suffer from a vulnerability that allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Vulnerability Detail
The vulnerability in the Jenkins Kubernetes CLI Plugin arises from the lack of proper permission checks in several HTTP endpoints. This oversight enables attackers with Overall/Read permission to retrieve the credentials IDs of stored credentials in Jenkins. By exploiting this vulnerability, an attacker could gain unauthorized access to sensitive information, potentially leading to further compromise of the Jenkins environment. The Common Vulnerabilities and Exposures (CVE) identifier for this vulnerability is CVE-2021-21661. The vulnerability has a CVSSv3 score of 4.3, indicating a moderate severity level.
How To Fix
Minimum fixed version
1.10.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround available for this vulnerability. However, users can mitigate the risk by ensuring that only trusted users have Overall/Read permission in Jenkins. Additionally, it is crucial to regularly monitor and review the permissions assigned to users and restrict access to sensitive credentials.
Conclusion
The Jenkins Kubernetes CLI Plugin versions 1.10.0 and earlier are vulnerable to a missing authorization issue that allows attackers with Overall/Read permission to enumerate credentials IDs. Upgrading to version 1.10.1 or later is recommended to fix this vulnerability. It is also important to review and restrict user permissions to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:kubernetes-cli →
FAQ
The vulnerability allows attackers with Overall/Read permission to enumerate credentials IDs of stored credentials in Jenkins, potentially leading to unauthorized access to sensitive information.
You can use the Vulert Playground at Vulert Scanner to check if your Jenkins environment is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file for analysis.
Yes, upgrading to version 1.10.1 or later of the Jenkins Kubernetes CLI Plugin fixes this vulnerability by implementing proper permission checks in the affected HTTP endpoints.
While there is no specific workaround, you can mitigate the risk by ensuring that only trusted users have Overall/Read permission in Jenkins and regularly reviewing user permissions.
The CVSSv3 score for this vulnerability is 4.3, indicating a moderate severity level.
