CVE-2021-21617
📋 TL;DR
This CSRF vulnerability in Jenkins Configuration Slicing Plugin allows attackers to trick authenticated users into unknowingly applying malicious slice configurations. Attackers can modify Jenkins job configurations without authorization. Affects Jenkins instances with Configuration Slicing Plugin 1.51 or earlier installed.
💻 Affected Systems
- Jenkins Configuration Slicing Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could reconfigure Jenkins jobs to execute arbitrary code, steal credentials, or disrupt CI/CD pipelines, potentially leading to supply chain compromise.
Likely Case
Attackers modify job configurations to insert malicious build steps, potentially leading to credential theft or unauthorized code execution within Jenkins environment.
If Mitigated
With proper CSRF protections and network segmentation, impact is limited to unauthorized configuration changes within the Jenkins instance.
🎯 Exploit Status
CSRF attacks are well-understood and easy to weaponize. Requires social engineering to trick authenticated users.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.52
Vendor Advisory: https://www.jenkins.io/security/advisory/2021-02-24/#SECURITY-2003
Restart Required: Yes
Instructions:
1. Update Jenkins Configuration Slicing Plugin to version 1.52 or later via Jenkins Plugin Manager. 2. Restart Jenkins service. 3. Verify plugin version in Installed Plugins list.
🔧 Temporary Workarounds
Enable CSRF Protection
allEnsure Jenkins CSRF protection is enabled globally
Check Jenkins > Configure Global Security > Enable CSRF Protection
Network Segmentation
allRestrict Jenkins access to trusted networks only
Configure firewall rules to limit Jenkins web interface access
🧯 If You Can't Patch
- Implement strict network access controls to limit Jenkins web interface exposure
- Educate users about CSRF risks and implement additional authentication for configuration changes
🔍 How to Verify
Check if Vulnerable:
Check Jenkins Plugin Manager for Configuration Slicing Plugin version. If version is 1.51 or earlier, system is vulnerable.Check Version:
Check via Jenkins web interface: Manage Jenkins > Manage Plugins > Installed tabVerify Fix Applied:
Verify Configuration Slicing Plugin version is 1.52 or later in Jenkins Plugin Manager.📡 Detection & Monitoring
Log Indicators:
- Unexpected configuration changes in Jenkins logs
- Multiple configuration update requests from same user in short timeframe
Network Indicators:
- HTTP POST requests to /slicing/apply without proper CSRF tokens
- External domains making requests to Jenkins configuration endpoints
SIEM Query:
source="jenkins.log" AND ("configuration slicing" OR "/slicing/apply") AND status=200