CVE-2021-21665
📋 TL;DR
This CSRF vulnerability in Jenkins XebiaLabs XL Deploy Plugin allows attackers to trick authenticated users into connecting Jenkins to attacker-controlled servers using stolen credential IDs. This enables credential theft of usernames and passwords stored in Jenkins. Affects Jenkins instances with XL Deploy Plugin 10.0.1 or earlier installed.
💻 Affected Systems
- Jenkins XebiaLabs XL Deploy Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal all stored credentials from Jenkins, potentially compromising downstream systems, infrastructure, and sensitive data.
Likely Case
Targeted credential theft leading to unauthorized access to connected systems and potential lateral movement.
If Mitigated
Limited impact with proper CSRF protections, credential isolation, and network segmentation in place.
🎯 Exploit Status
Requires social engineering or other methods to deliver CSRF payload to authenticated users. Credential IDs must be obtained separately.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.0.2
Vendor Advisory: https://www.jenkins.io/security/advisory/2021-06-10/#SECURITY-1982
Restart Required: Yes
Instructions:
1. Update Jenkins XL Deploy Plugin to version 10.0.2 or later via Jenkins Plugin Manager. 2. Restart Jenkins instance. 3. Verify plugin version in installed plugins list.
🔧 Temporary Workarounds
Enable CSRF Protection
allEnsure Jenkins CSRF protection is enabled globally
Check Jenkins Configure Global Security settings for CSRF protection
Restrict Network Access
allLimit Jenkins server's outbound network connections
Configure firewall rules to restrict Jenkins outbound connections
🧯 If You Can't Patch
- Disable or remove XL Deploy Plugin if not essential
- Implement strict network segmentation and monitor for unusual outbound connections
🔍 How to Verify
Check if Vulnerable:
Check Jenkins plugin manager for XL Deploy Plugin version 10.0.1 or earlierCheck Version:
Check via Jenkins web UI: Manage Jenkins > Manage Plugins > Installed tabVerify Fix Applied:
Verify XL Deploy Plugin version is 10.0.2 or later in Jenkins plugin manager📡 Detection & Monitoring
Log Indicators:
- Unusual plugin configuration changes
- Failed authentication attempts to new endpoints
Network Indicators:
- Jenkins server making unexpected outbound connections
- Traffic to unfamiliar domains/IPs
SIEM Query:
source="jenkins.log" AND ("XL Deploy" OR "plugin.configure") AND (error OR failed OR unauthorized)