CVE-2021-21642
📋 TL;DR
This vulnerability in Jenkins Config File Provider Plugin allows attackers to perform XML External Entity (XXE) attacks by exploiting improper XML parser configuration. Attackers can read arbitrary files from the Jenkins controller file system, potentially exposing sensitive data. Organizations using Jenkins with this plugin version 3.7.0 or earlier are affected.
💻 Affected Systems
- Jenkins Config File Provider Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of Jenkins controller with arbitrary file read, potentially exposing credentials, configuration files, and sensitive data stored on the server.
Likely Case
Unauthorized reading of sensitive files from the Jenkins controller file system, potentially exposing credentials, configuration data, and other sensitive information.
If Mitigated
Limited impact with proper network segmentation and access controls, though file read capability remains possible if exploited.
🎯 Exploit Status
Exploitation requires authenticated access to Jenkins, but the attack technique is well-documented and relatively simple to implement.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.7.1
Vendor Advisory: https://www.jenkins.io/security/advisory/2021-04-21/#SECURITY-2204
Restart Required: Yes
Instructions:
1. Update Jenkins Config File Provider Plugin to version 3.7.1 or later via Jenkins Plugin Manager. 2. Restart Jenkins to apply the update. 3. Verify the plugin version is updated in the Installed Plugins list.
🔧 Temporary Workarounds
Disable vulnerable plugin
allTemporarily disable the Config File Provider Plugin if immediate patching is not possible
Navigate to Manage Jenkins > Manage Plugins > Installed tab > Find Config File Provider Plugin > Click Disable
Restrict plugin access
allLimit which users can access the Config File Provider Plugin functionality
Configure Jenkins security matrix to restrict plugin access to trusted users only
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Jenkins from sensitive systems
- Apply principle of least privilege to Jenkins service accounts and file system permissions
🔍 How to Verify
Check if Vulnerable:
Check plugin version in Jenkins: Manage Jenkins > Manage Plugins > Installed tab > Look for Config File Provider Plugin versionCheck Version:
Check Jenkins plugin directory or use Jenkins CLI: java -jar jenkins-cli.jar -s http://jenkins-url/ list-plugins | grep 'Config File Provider'Verify Fix Applied:
Verify plugin version is 3.7.1 or later in the Installed Plugins list📡 Detection & Monitoring
Log Indicators:
- Unusual XML parsing errors in Jenkins logs
- Multiple failed authentication attempts followed by successful access to Config File Provider
Network Indicators:
- Unusual outbound connections from Jenkins server after XML file uploads
- Patterns of XML file uploads to Config File Provider endpoints
SIEM Query:
source="jenkins.log" AND ("Config File Provider" OR "XML parsing error" OR "XXE")