CVE-2021-21685: Jenkins Privilege Escalation Vulnerability

CVE-2021-21685 Overview

CVE-2021-21685 is a missing authorization vulnerability [CWE-862] in Jenkins, the widely deployed open-source automation server. Jenkins versions 2.318 and earlier, and LTS versions 2.303.2 and earlier, fail to check agent-to-controller access when creating parent directories in the FilePath#mkdirs method. A malicious agent process can manipulate the controller file system without proper authorization checks. The flaw affects the trust boundary between Jenkins controllers and build agents, undermining the agent-to-controller security subsystem introduced to restrict untrusted agent operations.

Critical Impact
A compromised or malicious Jenkins build agent can create arbitrary parent directories on the controller file system, bypassing the agent-to-controller access control framework and enabling further attacks against the controller.

Affected Products

Jenkins weekly releases 2.318 and earlier
Jenkins LTS 2.303.2 and earlier
Deployments operating with untrusted or externally provisioned build agents

Discovery Timeline

2021-11-04 - Jenkins publishes Security Advisory SECURITY-2455
2021-11-04 - CVE-2021-21685 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-21685

Vulnerability Analysis

The vulnerability resides in the FilePath#mkdirs method within the Jenkins core. Jenkins uses the FilePath abstraction to represent files on either the controller or an agent, and remote operations are subject to the agent-to-controller access control subsystem. This subsystem enforces that operations initiated by an agent on controller-side files require explicit permission. The mkdirs operation, which creates a directory and any missing parent directories, did not invoke the access control check for the parent directory creation path. As a result, an agent process executing remote code paths against the controller could create directories outside the scope normally permitted to it. The defect breaks the assumption that agents cannot modify arbitrary locations on the controller file system, which is foundational to Jenkins' multi-tenant build security model.

Root Cause

The root cause is missing authorization enforcement [CWE-862] in the directory creation logic. The code path responsible for creating parent directories did not delegate to the agent-to-controller access checker before executing the file system operation. See the Jenkins Security Advisory SECURITY-2455 for the technical fix details.

Attack Vector

Exploitation requires control of a Jenkins build agent or the ability to influence code that runs in the agent context. Attackers who compromise an agent, or who can run builds on a less-trusted agent, can issue remote FilePath#mkdirs calls targeting controller-side paths. Successful exploitation lets the attacker create directory structures on the controller, which can serve as a precursor to writing files, staging plugins, or interfering with Jenkins operation in combination with other weaknesses. The attack proceeds over the existing JNLP or inbound agent channel and does not require additional authentication beyond agent connectivity.

No public proof-of-concept code is available for this issue. Refer to the vendor advisory for protocol-level technical details.

Detection Methods for CVE-2021-21685

Indicators of Compromise

Unexpected directories appearing on the Jenkins controller file system outside of JENKINS_HOME/jobs and standard workspace paths
Agent-initiated remote file operations logged in $JENKINS_HOME/logs with anomalous target paths
Build agents executing pipeline steps that reference controller-side absolute paths

Detection Strategies

Audit Jenkins controller version against the fixed releases and flag any instance at or below 2.318 or LTS 2.303.2
Review pipeline and freestyle job definitions for use of FilePath operations targeting controller paths from agent contexts
Correlate agent connection events with subsequent controller file system changes using file integrity monitoring

Monitoring Recommendations

Enable Jenkins audit logging and forward controller logs to a centralized analytics platform for retention and search
Monitor JENKINS_HOME for directory creation events using host-based file integrity monitoring
Track agent process behavior on the controller host and alert on unexpected child processes or file operations

How to Mitigate CVE-2021-21685

Immediate Actions Required

Upgrade Jenkins weekly to version 2.319 or later, or Jenkins LTS to 2.303.3 or later, as directed by the vendor advisory
Inventory all build agents and revoke connectivity for agents that are not strictly required
Restrict which projects can execute on which agents using agent labels and authorization strategies

Patch Information

Jenkins addressed the issue by adding the missing agent-to-controller access check to FilePath#mkdirs. Apply the fix by upgrading to Jenkins 2.319 (weekly) or Jenkins LTS 2.303.3. Full remediation guidance is published in the Jenkins Security Advisory SECURITY-2455 and tracked on the Openwall OSS Security list.

Workarounds

Treat all build agents as untrusted and avoid running builds from untrusted sources on shared agents
Use the Jenkins agent-to-controller access control rules to deny additional sensitive paths where feasible
Isolate the Jenkins controller from build workloads by running all jobs on dedicated agents with no privileged controller access

bash

# Verify the installed Jenkins version on the controller
java -jar jenkins.war --version

# Example upgrade path on a Debian/Ubuntu LTS deployment
sudo systemctl stop jenkins
sudo apt-get update && sudo apt-get install --only-upgrade jenkins
sudo systemctl start jenkins