PT-2021-14727 · Jenkins · Jenkins+1

Daniel Beck · Published 2021-10-06 · Updated 2023-11-22 · CVE-2021-21684

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Git Plugin versions 4.8.2 and earlier

Description The issue arises from the failure to escape Git SHA-1 checksum parameters provided to commit notifications when displayed in a build cause, resulting in a stored cross-site scripting (XSS) vulnerability. This vulnerability is exploitable by attackers able to submit crafted commit notifications to the "/git/notifyCommit" endpoint. The vulnerability is only exploitable in certain versions of Jenkins, specifically 2.314 and earlier, and LTS 2.303.1 and earlier.

Recommendations For Jenkins Git Plugin versions 4.8.2 and earlier, update to version 4.8.3 or later, which rejects Git SHA-1 checksum parameters that do not match the expected format and sanitizes existing values when displayed on the UI. As a temporary workaround, consider restricting access to the "/git/notifyCommit" endpoint until the issue is resolved.

Fix

XSS

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-79

CWE-116

Related Identifiers

CVE-2021-21684

GHSA-GGHC-G8CJ-4VFV

RHSA-2022:0055

Affected Products

Jenkins

Jenkins Git Plugin

References · 8

• https://jenkins.io/security/advisory/2021-10-06/#SECURITY-2499 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21684 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21684 · Security Note
• https://osv.dev/vulnerability/GHSA-gghc-g8cj-4vfv · Vendor Advisory
• https://github.com/jenkinsci/git-plugin · Note
• https://github.com/jenkinsci/git-plugin/commit/5474cc942bfba60927be629ff47fb41c38c66741 · Note
• https://t.me/cvenotify/22040 · Telegram Post
• http://openwall.com/lists/oss-security/2021/10/06/1 · Note