PT-2021-14701 · Jenkins · Jenkins Nuget Plugin+1

Kevin Guerroudj · Published 2021-05-25 · Updated 2023-10-25 · CVE-2021-21658

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Nuget Plugin versions 1.0 and earlier

Description The issue concerns the XML parser in the Jenkins Nuget Plugin, which does not prevent XML external entity (XXE) attacks. This parser is used for the "Build on NuGet updates" feature, allowing attackers who can control the contents of the packages.config file to parse crafted XML documents. This can lead to the extraction of secrets from the Jenkins controller or server-side request forgery.

Recommendations For Jenkins Nuget Plugin versions 1.0 and earlier, update to version 1.1 or later, which disables external entity resolution for its XML parser.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2021-21658

GHSA-P674-HH8X-RV5H

Affected Products

Jenkins

Jenkins Nuget Plugin

References · 8

• https://osv.dev/vulnerability/CVE-2021-21658 · Vendor Advisory
• https://jenkins.io/security/advisory/2021-05-25/#SECURITY-2340 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21658 · Security Note
• https://osv.dev/vulnerability/GHSA-p674-hh8x-rv5h · Vendor Advisory
• https://github.com/jenkinsci/nuget-plugin/commit/542bf38ac52f045741a5670e1644af351878f7e0 · Note
• https://github.com/jenkinsci/nuget-plugin/commit/c8ed4cb5b1c42f3c407f9f418b4e0b4274bea5a9 · Note
• https://github.com/jenkinsci/nuget-plugin · Note
• http://openwall.com/lists/oss-security/2021/05/25/3 · Note