CVE-2021-21637

The Jenkins Team Foundation Server Plugin versions 5.157.1 and earlier contain a missing permission check in an HTTP endpoint. This flaw allows an attacker with Overall/Read permission to trigger a connection to an attacker-specified URL using attacker-specified credentials IDs [2][3].

To exploit this vulnerability, the attacker must have Overall/Read permission, which is a low-privilege permission. Additionally, the attacker needs to obtain valid credentials IDs through other means, such as another vulnerability or exposure. The attacker then crafts a request to the affected endpoint to connect to an external URL under their control, supplying the stolen credentials IDs [2].

Successful exploitation results in the attacker capturing the credentials stored in Jenkins as they are sent to the attacker-controlled URL. This can lead to credential theft and potential compromise of Jenkins and connected systems [3].

At the time of the security advisory (2021-03-30), no fix was available for this vulnerability. Users were advised to restrict Overall/Read permission or apply other mitigations [2]. Later plugin versions may address this issue.