CVE-2021-21695
📋 TL;DR
This vulnerability in Jenkins allows agents to access files outside their permitted directories by exploiting symbolic links. Attackers can read sensitive files on the Jenkins controller, potentially exposing credentials, configuration data, or source code. It affects Jenkins 2.318 and earlier, and LTS 2.303.2 and earlier.
💻 Affected Systems
- Jenkins
📦 What is this software?
Jenkins by Jenkins
Jenkins by Jenkins
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of Jenkins controller with exposure of all files, including credentials, SSH keys, and sensitive configuration data, potentially leading to lateral movement in the environment.
Likely Case
Unauthorized reading of sensitive files on the Jenkins controller, exposing credentials, API keys, and configuration secrets that could be used for further attacks.
If Mitigated
Limited impact with proper agent isolation and file system permissions preventing access to critical system files.
🎯 Exploit Status
Exploitation requires control over a Jenkins agent or ability to create/modify symbolic links through agent operations. Public proof-of-concept exists in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Jenkins 2.319, Jenkins LTS 2.303.3
Vendor Advisory: https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2455
Restart Required: Yes
Instructions:
1. Backup your Jenkins instance. 2. Upgrade to Jenkins 2.319 or later, or Jenkins LTS 2.303.3 or later. 3. Restart Jenkins service. 4. Verify the upgrade completed successfully.
🔧 Temporary Workarounds
Restrict agent file system access
allLimit agent permissions to prevent file system operations that could exploit symbolic links
Configure agent security settings to restrict file system access in Jenkins security configuration
Disable symbolic link following
allConfigure Jenkins to not follow symbolic links in agent operations
Set system property -Dhudson.FilePath.disabledSymlinkSupport=true in Jenkins startup parameters
🧯 If You Can't Patch
- Implement strict agent isolation and limit agent permissions to minimal required access
- Monitor for suspicious file access patterns and implement file integrity monitoring on Jenkins controller
🔍 How to Verify
Check if Vulnerable:
Check Jenkins version via Manage Jenkins > About Jenkins or via CLI with 'java -jar jenkins.war --version'Check Version:
java -jar jenkins.war --version 2>&1 | head -1Verify Fix Applied:
Verify Jenkins version is 2.319 or later, or LTS 2.303.3 or later, and test that agents cannot access files outside permitted directories📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns from agents
- Access to files outside agent workspace directories
- Security audit logs showing file path traversal attempts
Network Indicators:
- Unusual agent-to-controller file transfer patterns
- Large data exfiltration from Jenkins controller
SIEM Query:
source="jenkins.log" AND ("FilePath" OR "symbolic link" OR "directory traversal") AND ("access denied" OR "permission error")