PT-2021-14722 · Jenkins · Jenkins Azure Ad Plugin+1

Daniel Beck · Published 2021-08-31 · Updated 2023-11-22 · CVE-2021-21679

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Azure AD Plugin versions 164.v5b48baa961d2 through 179.vf6841393099e

Description The issue allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins. This is due to an overly permissive implementation of an extension point in the Jenkins Azure AD Plugin, which is intended to selectively disable cross-site request forgery protection for specific URLs. The vulnerability was originally introduced in Azure AD Plugin 164.v5b48baa961d2.

Recommendations For Jenkins Azure AD Plugin versions 164.v5b48baa961d2 through 179.vf6841393099e, update to version 180.v8b1e80e6f242 or later, which no longer allows bypassing CSRF protection for URLs used by the JavaScript component. As a temporary workaround, consider reconfiguring the JavaScript component to pass the expected CSRF token until a patch is available.

Fix

Protection Mechanism Failure

CSRF

Weakness Enumeration

CWE-693

CWE-352

Related Identifiers

CVE-2021-21679

GHSA-X77R-7M5W-PQQ2

Affected Products

Jenkins

Jenkins Azure Ad Plugin

References · 8

• https://jenkins.io/security/advisory/2021-08-31/#SECURITY-2470 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21679 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21679 · Security Note
• https://osv.dev/vulnerability/GHSA-x77r-7m5w-pqq2 · Vendor Advisory
• https://github.com/jenkinsci/azure-ad-plugin · Note
• https://github.com/jenkinsci/azure-ad-plugin/commit/8b1e80e6f242275127ebb177e2a755a2104b4853 · Note
• http://openwall.com/lists/oss-security/2021/08/31/1 · Note
• https://t.me/cibsecurity/28093 · Telegram Post