CVE-2021-21657: 
Java vulnerability analysis and mitigation

CVE-2021-21657 (SECURITY-2339) is an XML External Entity (XXE) vulnerability discovered in the Jenkins Filesystem Trigger Plugin. The vulnerability was disclosed on May 25, 2021, affecting versions 0.40 and earlier of the plugin. This security issue was identified in the plugin's XML parser configuration, which lacked proper protection against XXE attacks (Jenkins Advisory).

The vulnerability stems from an improperly configured XML parser in the Filesystem Trigger Plugin that does not prevent XML external entity (XXE) attacks. The severity is rated as High according to the CVSS scoring system. The technical issue specifically relates to the plugin's XML parsing functionality when polling for file changes (Jenkins Advisory).

The vulnerability allows attackers with Job/Configure permission or those able to control the contents of an XML file being polled for changes to execute various malicious actions. These include extraction of secrets from the polling Jenkins controller or agent, server-side request forgery (SSRF), and denial-of-service attacks through crafted XML documents that use external entities (Jenkins Advisory).

The vulnerability is exploitable by attackers who have Job/Configure permission in Jenkins or can control the contents of XML files that are being monitored for changes by the Filesystem Trigger Plugin. The attacker would need to craft a specific XML document that leverages external entities to execute the attack (Jenkins Advisory).

The vulnerability has been fixed in Filesystem Trigger Plugin version 0.41, which disables external entity resolution for its XML parser. Users are strongly advised to update to this version to mitigate the vulnerability. All versions up to and including 0.40 are considered vulnerable (Jenkins Advisory).

The vulnerability was discovered and reported by security researcher Kevin Guerroudj, who also identified similar XXE vulnerabilities in other Jenkins plugins during the same period (Jenkins Advisory).