CVE-2021-21687

Vulnerability

Jenkins core versions 2.318 and earlier, and LTS 2.303.2 and earlier, do not properly check agent-to-controller access permissions when creating symbolic links during the unarchiving process in the FilePath#untar method. Specifically, when extracting a tar archive containing a symbolic link, the method does not verify that the agent has permission to create that link, potentially allowing operations outside allowed directories [1][2].

Exploitation

An attacker with agent control (e.g., a malicious agent or a compromised agent) can craft a tar archive containing symbolic links that point to sensitive files on the Jenkins controller file system. When the agent triggers the FilePath#untar operation on the controller, the symbolic link is created without proper access control checks, enabling the attacker to later read or write to those paths via other file operations [1].

Impact

Successful exploitation allows an attacker to bypass the agent-to-controller access control subsystem and achieve arbitrary read and write access to files on the Jenkins controller file system. This can lead to full compromise of the Jenkins controller, including disclosure of secrets, credentials, and potential remote code execution [1][2].

Mitigation

The vulnerability is fixed in Jenkins 2.319 and LTS 2.303.3. Users should upgrade to these versions or later. No workarounds are available. Jenkins has also released a security advisory detailing the issue [1].