CVE-2021-21655
📋 TL;DR
This CSRF vulnerability in Jenkins P4 Plugin allows attackers to trick authenticated users into connecting Jenkins to a malicious Perforce server with attacker-controlled credentials. This affects all Jenkins instances using P4 Plugin version 1.11.4 or earlier. Attackers could potentially steal source code or inject malicious code into builds.
💻 Affected Systems
- Jenkins P4 Plugin
📦 What is this software?
P4 by Jenkins
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain access to source code repositories, inject malicious code into production builds, or compromise the entire Jenkins instance through subsequent attacks.
Likely Case
Source code theft, unauthorized access to version control systems, or disruption of build pipelines.
If Mitigated
Limited impact if CSRF protections are properly implemented and Jenkins is not internet-facing.
🎯 Exploit Status
Exploitation requires tricking an authenticated user to visit a malicious page. No public exploit code is known, but the attack pattern is well-understood.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.11.5
Vendor Advisory: https://www.jenkins.io/security/advisory/2021-05-11/#SECURITY-2327
Restart Required: Yes
Instructions:
1. Update Jenkins P4 Plugin to version 1.11.5 or later via Jenkins Plugin Manager. 2. Restart Jenkins after update. 3. Verify plugin version in Manage Jenkins > Manage Plugins.
🔧 Temporary Workarounds
Enable CSRF Protection
allEnsure Jenkins CSRF protection is enabled globally
Check: Manage Jenkins > Configure Global Security > Enable 'Prevent Cross Site Request Forgery exploits'
Restrict Network Access
allLimit Jenkins access to trusted networks only
Configure firewall rules to restrict Jenkins web interface to internal networks
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Jenkins from untrusted networks
- Use browser security extensions that block CSRF attempts and educate users about phishing risks
🔍 How to Verify
Check if Vulnerable:
Check P4 Plugin version in Jenkins: Manage Jenkins > Manage Plugins > Installed tab, look for 'P4 Plugin' versionCheck Version:
On Jenkins server: java -jar jenkins-cli.jar -s http://localhost:8080/ list-plugins | grep p4Verify Fix Applied:
Verify P4 Plugin version is 1.11.5 or higher in Manage Jenkins > Manage Plugins📡 Detection & Monitoring
Log Indicators:
- Unusual Perforce server connections in Jenkins logs
- Failed authentication attempts to unexpected Perforce servers
Network Indicators:
- Outbound connections from Jenkins to unknown Perforce servers on port 1666
SIEM Query:
source="jenkins.log" AND "P4 Plugin" AND ("connection failed" OR "authentication failed")