CVE-2021-21657
📋 TL;DR
This vulnerability in Jenkins Filesystem Trigger Plugin allows attackers to perform XML External Entity (XXE) attacks by exploiting improper XML parser configuration. Attackers can read arbitrary files from the Jenkins controller file system, potentially exposing sensitive data. All Jenkins instances using Filesystem Trigger Plugin version 0.40 or earlier are affected.
💻 Affected Systems
- Jenkins Filesystem Trigger Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of Jenkins controller with arbitrary file read, potentially exposing credentials, configuration files, and sensitive data stored on the server.
Likely Case
Unauthorized reading of sensitive files from Jenkins controller, including credentials, configuration files, and potentially source code.
If Mitigated
Limited impact with proper network segmentation and file system permissions, though XXE attacks could still succeed if plugin is used.
🎯 Exploit Status
Exploitation requires attacker to have access to trigger file system monitoring events or control XML input to the plugin. XXE attacks are well-documented and relatively easy to execute.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Filesystem Trigger Plugin 0.41 or later
Vendor Advisory: https://www.jenkins.io/security/advisory/2021-05-25/#SECURITY-2339
Restart Required: Yes
Instructions:
1. Update Jenkins to latest version. 2. Navigate to Manage Jenkins > Manage Plugins. 3. Update Filesystem Trigger Plugin to version 0.41 or later. 4. Restart Jenkins service.
🔧 Temporary Workarounds
Disable Filesystem Trigger Plugin
allTemporarily disable the vulnerable plugin until patching is possible
Navigate to Manage Jenkins > Manage Plugins > Installed tab
Find Filesystem Trigger Plugin and click Disable
Remove plugin files
linuxManually remove the plugin files from Jenkins installation
Stop Jenkins service
Remove $JENKINS_HOME/plugins/filesystem-trigger.jpi
Remove $JENKINS_HOME/plugins/filesystem-trigger directory
Start Jenkins service
🧯 If You Can't Patch
- Disable Filesystem Trigger Plugin immediately
- Implement strict network access controls to limit who can access Jenkins instance
- Monitor file system access logs for unusual read patterns
🔍 How to Verify
Check if Vulnerable:
Check plugin version in Jenkins web interface: Manage Jenkins > Manage Plugins > Installed tab, look for Filesystem Trigger Plugin versionCheck Version:
Check $JENKINS_HOME/plugins/filesystem-trigger.jpi file version or use Jenkins CLI: java -jar jenkins-cli.jar -s http://localhost:8080/ list-plugins | grep filesystem-triggerVerify Fix Applied:
Verify Filesystem Trigger Plugin version is 0.41 or higher in Manage Plugins interface📡 Detection & Monitoring
Log Indicators:
- Unusual file read operations in Jenkins logs
- XML parsing errors related to external entities
- Multiple failed authentication attempts followed by plugin usage
Network Indicators:
- Unusual XML payloads sent to Jenkins endpoints
- Outbound connections from Jenkins to unexpected external systems
SIEM Query:
source="jenkins.log" AND ("XXE" OR "external entity" OR "filesystem-trigger" AND "error")