CVE-2021-21691
📋 TL;DR
This vulnerability allows Jenkins agents to create symbolic links on the controller without proper permission checks. Attackers with agent access can potentially write arbitrary files to sensitive locations, leading to privilege escalation or remote code execution. All Jenkins instances with agent connections are affected.
💻 Affected Systems
- Jenkins
📦 What is this software?
Jenkins by Jenkins
Jenkins by Jenkins
⚠️ Risk & Real-World Impact
Worst Case
Full compromise of Jenkins controller via arbitrary file write leading to remote code execution as Jenkins service account, potentially enabling lateral movement in the environment.
Likely Case
Privilege escalation within Jenkins, unauthorized access to sensitive files, or disruption of Jenkins operations through file system manipulation.
If Mitigated
Limited impact if proper network segmentation and agent access controls are implemented, restricting agent-to-controller communication.
🎯 Exploit Status
Exploitation requires agent access but is straightforward once agent connection is established. Public exploit details are available in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Jenkins 2.319, LTS 2.303.3
Vendor Advisory: https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2455
Restart Required: Yes
Instructions:
1. Backup Jenkins configuration and data. 2. Upgrade Jenkins to version 2.319 or later, or LTS 2.303.3 or later. 3. Restart Jenkins service. 4. Verify upgrade completed successfully.
🔧 Temporary Workarounds
Restrict agent permissions
allRemove symlink permission from agent-to-controller access control
Navigate to Manage Jenkins > Configure Global Security > Agent to Controller Access Control
Remove 'symlink' permission from all agent configurations
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Jenkins agents from sensitive systems
- Monitor for suspicious file creation activities and agent behavior anomalies
🔍 How to Verify
Check if Vulnerable:
Check Jenkins version via web interface (Manage Jenkins > About Jenkins) or command line: java -jar jenkins.war --versionCheck Version:
java -jar jenkins.war --versionVerify Fix Applied:
Confirm version is 2.319+ or LTS 2.303.3+ and verify symlink permission is properly restricted in agent access control settings📡 Detection & Monitoring
Log Indicators:
- Unauthorized symlink creation attempts in Jenkins logs
- Agent permission escalation events
- File system changes from Jenkins agent processes
Network Indicators:
- Unusual agent-to-controller file transfer patterns
- Agent connections attempting to access restricted file paths
SIEM Query:
source="jenkins.log" AND ("symlink" OR "permission denied" OR "access control")