CVE-2021-21689
📋 TL;DR
This vulnerability in Jenkins allows agents to bypass access controls and execute arbitrary file operations on the controller's filesystem. It affects Jenkins instances with agent-to-controller security enabled, potentially allowing unauthorized file extraction and manipulation.
💻 Affected Systems
- Jenkins
📦 What is this software?
Jenkins by Jenkins
Jenkins by Jenkins
⚠️ Risk & Real-World Impact
Worst Case
An attacker with agent access could extract malicious archives to arbitrary locations on the controller, leading to remote code execution, data theft, or complete system compromise.
Likely Case
Malicious agents could overwrite critical configuration files, install backdoors, or extract sensitive data from the controller filesystem.
If Mitigated
With proper agent-to-controller access controls, only authorized file operations would be permitted, limiting impact to intended functionality.
🎯 Exploit Status
Exploitation requires access to a Jenkins agent, but the vulnerability itself is straightforward to exploit once agent access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Jenkins 2.319, Jenkins LTS 2.303.3
Vendor Advisory: https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2455
Restart Required: Yes
Instructions:
1. Backup your Jenkins instance. 2. Upgrade to Jenkins 2.319 or later, or Jenkins LTS 2.303.3 or later. 3. Restart Jenkins. 4. Verify the upgrade was successful.
🔧 Temporary Workarounds
Disable vulnerable file operations
allRemove or restrict access to FilePath#unzip and FilePath#untar methods in Jenkins scripts and pipelines
Review and modify Jenkinsfiles and pipeline scripts to avoid using vulnerable file operations
Restrict agent permissions
allTighten agent-to-controller security settings to limit what agents can access
Configure agent security settings in Jenkins Manage Jenkins > Configure Global Security
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Jenkins agents from sensitive systems
- Enable comprehensive logging and monitoring of all agent-to-controller file operations
🔍 How to Verify
Check if Vulnerable:
Check Jenkins version via Manage Jenkins > About Jenkins or via CLI with 'java -jar jenkins.war --version'Check Version:
java -jar jenkins.war --versionVerify Fix Applied:
Verify Jenkins version is 2.319 or later, or LTS 2.303.3 or later, and test that agent file operations are properly restricted📡 Detection & Monitoring
Log Indicators:
- Unusual file extraction operations from agents
- Archive extraction to unexpected locations
- Agent-initiated file writes to sensitive paths
Network Indicators:
- Unexpected agent-to-controller file transfer patterns
- Archive files being sent from agents to controller
SIEM Query:
source="jenkins.log" AND ("unzip" OR "untar" OR "extract") AND agent_activity=true