CVE-2021-21638
📋 TL;DR
This CSRF vulnerability in Jenkins Team Foundation Server Plugin allows attackers to trick authenticated users into unknowingly connecting Jenkins to attacker-controlled servers using stolen credential IDs. This could expose sensitive credentials stored in Jenkins. Affects Jenkins instances with the vulnerable plugin installed.
💻 Affected Systems
- Jenkins Team Foundation Server Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers capture all credentials stored in Jenkins, potentially gaining access to source code repositories, deployment systems, and other connected services.
Likely Case
Attackers steal specific credentials for connected systems like TFS/Azure DevOps, leading to unauthorized access to source code and CI/CD pipelines.
If Mitigated
With proper CSRF protections and credential access controls, impact is limited to specific plugin functionality.
🎯 Exploit Status
Requires CSRF attack against authenticated user plus credential ID enumeration. No public exploit code known.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.157.2
Vendor Advisory: https://www.jenkins.io/security/advisory/2021-03-30/#SECURITY-2283
Restart Required: Yes
Instructions:
1. Update Jenkins Team Foundation Server Plugin to version 5.157.2 or later via Jenkins Plugin Manager. 2. Restart Jenkins after update.
🔧 Temporary Workarounds
Disable Plugin
allTemporarily disable the vulnerable plugin if immediate patching is not possible.
java -jar jenkins-cli.jar -s http://jenkins-url/ disable-plugin tfs
Enable CSRF Protection
allEnsure Jenkins CSRF protection is enabled globally.
🧯 If You Can't Patch
- Restrict network access to Jenkins admin interface
- Implement strict credential access controls and monitoring
🔍 How to Verify
Check if Vulnerable:
Check plugin version in Jenkins Plugin Manager or via CLI: java -jar jenkins-cli.jar -s http://jenkins-url/ list-plugins | grep tfsCheck Version:
java -jar jenkins-cli.jar -s http://jenkins-url/ list-plugins | grep tfsVerify Fix Applied:
Verify plugin version is 5.157.2 or higher: java -jar jenkins-cli.jar -s http://jenkins-url/ list-plugins | grep 'tfs.*5.157.[2-9]'📡 Detection & Monitoring
Log Indicators:
- Unexpected TFS/Azure DevOps connection attempts
- Credential usage from unusual IPs
Network Indicators:
- Outbound connections to unknown TFS/Azure DevOps servers
SIEM Query:
source="jenkins.log" AND "Team Foundation Server" AND ("connection" OR "credential")