CVE-2021-21627

Overview

CVE-2021-21627 is a cross-site request forgery (CSRF) vulnerability in the Jenkins Libvirt Agents Plugin, affecting versions 1.9.0 and earlier. The plugin is used to manage virtual machine agents on hypervisors (Xen, KVM) for CI/CD pipelines. The flaw allows an attacker to craft a malicious request that, when executed by an authenticated Jenkins user, will stop hypervisor domains without the user's knowledge [1][2].

Exploitation

An attacker can exploit this by tricking a Jenkins user with appropriate permissions into visiting a malicious webpage or clicking a crafted link. Since the plugin does not require CSRF protection for the endpoint that stops libvirt domains, the attacker can perform unauthorized actions on the hypervisor [1][4]. No special network position is required beyond the ability to deliver the CSRF payload to the victim [2].

Impact

A successful attack results in stopping (i.e., forcibly halting) virtual machine domains managed by the Jenkins instance. This can disrupt CI/CD builds, cause service downtime, and potentially lead to data loss or corruption if VMs are abruptly terminated [1][4]. The impact is limited to stopping domains; the attacker does not gain code execution or persistent access to the hypervisor [3].

Mitigation

Users should upgrade the Libvirt Agents Plugin to version 1.9.1 or later, which includes CSRF protection for the vulnerable endpoint [2]. No workarounds are documented for older versions. As of March 2021, the vulnerability is publicly known, and administrators are advised to apply the update promptly [1][4].