CVE-2021-21633
📋 TL;DR
This CSRF vulnerability in Jenkins OWASP Dependency-Track Plugin allows attackers to trick authenticated users into connecting to malicious URLs, potentially stealing Jenkins credentials. It affects Jenkins instances with the vulnerable plugin installed. Attackers can capture sensitive credentials stored in Jenkins.
💻 Affected Systems
- Jenkins OWASP Dependency-Track Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal Jenkins credentials, gain full administrative access to Jenkins, and potentially compromise the entire CI/CD pipeline and connected systems.
Likely Case
Attackers capture credentials with sufficient permissions to access sensitive build artifacts, modify configurations, or deploy malicious code.
If Mitigated
With proper CSRF protections and network segmentation, impact is limited to credential exposure without lateral movement.
🎯 Exploit Status
Exploitation requires tricking authenticated users into visiting malicious pages. No authentication bypass needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.1.1
Vendor Advisory: https://www.jenkins.io/security/advisory/2021-03-30/#SECURITY-2250
Restart Required: Yes
Instructions:
1. Update Jenkins OWASP Dependency-Track Plugin to version 3.1.1 or later via Jenkins Plugin Manager. 2. Restart Jenkins after update.
🔧 Temporary Workarounds
Disable Plugin
allTemporarily disable the vulnerable plugin if immediate patching isn't possible.
Navigate to Jenkins > Manage Jenkins > Manage Plugins > Installed tab > Find 'OWASP Dependency-Track Plugin' > Disable
Enable CSRF Protection
allEnsure Jenkins CSRF protection is enabled globally.
Navigate to Jenkins > Manage Jenkins > Configure Global Security > Check 'Prevent Cross Site Request Forgery exploits'
🧯 If You Can't Patch
- Restrict network access to Jenkins to trusted IPs only
- Implement strict Content Security Policy headers
🔍 How to Verify
Check if Vulnerable:
Check plugin version in Jenkins > Manage Jenkins > Manage Plugins > Installed tab > Find 'OWASP Dependency-Track Plugin'Check Version:
curl -s http://jenkins-url/pluginManager/installed | grep -A2 'OWASP Dependency-Track Plugin'Verify Fix Applied:
Verify plugin version is 3.1.1 or higher in Jenkins Plugin Manager📡 Detection & Monitoring
Log Indicators:
- Unusual plugin configuration changes
- Failed authentication attempts from unexpected sources
Network Indicators:
- Outbound connections from Jenkins to unexpected external URLs
SIEM Query:
source="jenkins.log" AND "OWASP Dependency-Track Plugin" AND ("configuration" OR "connection")