PT-2021-14658 · Jenkins · Jenkins

Daniel Beck + 1 · Published 2021-01-26 · Updated 2024-03-06 · CVE-2021-21615

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.275 through 2.275 Jenkins LTS versions 2.263.2 through 2.263.2

Description The issue is caused by a time-of-check to time-of-use (TOCTOU) race condition, allowing attackers to read arbitrary files using the file browser for workspaces and archived artifacts. This is due to the file browser following symbolic links to locations outside the directory being browsed. Attackers with Job/Workspace permission and the ability to control workspace contents can create symbolic links to access files outside workspaces using the workspace browser.

Recommendations For Jenkins version 2.275, update to version 2.276 or later to resolve the issue. For Jenkins LTS version 2.263.2, update to version 2.263.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the workspace browser and archived artifacts to minimize the risk of exploitation.

Fix

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

BIT-JENKINS-2021-21615

CVE-2021-21615

GHSA-QXP6-27GW-99CJ

RHSA-2021:0423

RHSA-2021:0429

Affected Products

Jenkins

References · 7

• https://osv.dev/vulnerability/CVE-2021-21615 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21615 · Security Note
• https://osv.dev/vulnerability/BIT-jenkins-2021-21615 · Vendor Advisory
• https://jenkins.io/security/advisory/2021-01-26/#SECURITY-2197 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qxp6-27gw-99cj · Vendor Advisory
• http://openwall.com/lists/oss-security/2021/01/26/2 · Note
• https://t.me/cibsecurity/22604 · Telegram Post