CVE-2021-21629
📋 TL;DR
This CSRF vulnerability in Jenkins Build With Parameters Plugin allows attackers to trick authenticated users into unknowingly triggering builds with malicious parameters. It affects Jenkins instances using the vulnerable plugin version, potentially leading to unauthorized code execution or configuration changes.
💻 Affected Systems
- Jenkins Build With Parameters Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could execute arbitrary code on Jenkins agents, steal credentials, modify build configurations, or deploy malicious artifacts to production environments.
Likely Case
Attackers could trigger builds with malicious parameters to exfiltrate sensitive data, disrupt CI/CD pipelines, or inject malicious code into build artifacts.
If Mitigated
With proper CSRF protections and access controls, impact is limited to authorized parameter changes within existing project permissions.
🎯 Exploit Status
Exploitation requires tricking authenticated users into visiting malicious pages. CSRF tokens are not properly validated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.6 or later
Vendor Advisory: https://www.jenkins.io/security/advisory/2021-03-30/#SECURITY-2257
Restart Required: Yes
Instructions:
1. Update Jenkins Build With Parameters Plugin to version 1.6 or later via Jenkins Plugin Manager. 2. Restart Jenkins to apply the update. 3. Verify plugin version in Manage Jenkins > Manage Plugins.
🔧 Temporary Workarounds
Enable CSRF Protection
allEnsure Jenkins global security has CSRF protection enabled
Navigate to Manage Jenkins > Configure Global Security > Enable 'Prevent Cross Site Request Forgery exploits'
Restrict Build Permissions
allLimit who can build projects to reduce attack surface
Navigate to each project's configuration > Build Triggers > Restrict build permissions
🧯 If You Can't Patch
- Implement strict network segmentation and firewall rules to limit Jenkins access
- Use browser extensions that block CSRF attempts and educate users about phishing risks
🔍 How to Verify
Check if Vulnerable:
Check plugin version in Manage Jenkins > Manage Plugins > Installed tab > Build With Parameters PluginCheck Version:
curl -s http://jenkins-host/pluginManager/api/json?depth=1 | grep -o '"Build With Parameters Plugin[^}]*' | grep -o '"version":"[^"]*'Verify Fix Applied:
Verify plugin version is 1.6 or higher and test CSRF protection by attempting to trigger builds without proper tokens📡 Detection & Monitoring
Log Indicators:
- Unexpected build triggers with unusual parameters
- Failed CSRF token validation attempts in Jenkins logs
Network Indicators:
- HTTP POST requests to /job/*/buildWithParameters without proper referrer headers
- Multiple build triggers from same IP with different parameters
SIEM Query:
source="jenkins.log" AND ("CSRF" OR "buildWithParameters") AND status="200"