CVE-2021-21701: 
Java vulnerability analysis and mitigation

Jenkins Performance Plugin 3.20 and earlier contains an XML External Entity (XXE) vulnerability identified as CVE-2021-21701. The vulnerability was discovered by Adith Sudhakar working with Trend Micro Zero Day Initiative and was publicly disclosed on November 12, 2021. The affected component is the Performance Plugin for Jenkins, specifically versions up to and including 3.20 (Jenkins Advisory, ZDI Advisory).

The vulnerability exists within the TaurusParser class of the Performance Plugin. The core issue stems from improper configuration of the XML parser, which fails to prevent XML External Entity (XXE) attacks. The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (ZDI Advisory).

When exploited, this vulnerability allows attackers with the ability to control workspace contents to have Jenkins parse a crafted XML report file that uses external entities. This can lead to extraction of secrets from the Jenkins controller or enable server-side request forgery (SSRF) attacks. The vulnerability can be leveraged to disclose sensitive information in the context of the service account (Jenkins Advisory, ZDI Advisory).

As of the advisory publication on November 12, 2021, no fix was available for this vulnerability. The Jenkins security advisory explicitly states that there is no fix for the Performance Plugin (Jenkins Advisory).