CVE-2021-21660: Markdown formatter Cross-Site Scripting Vulnerability

MODERATE
Advisory Identifier: GHSA-xqpp-26pp-2365
Share
CVSS 5.4
CWE-79
Published
Advisory Summary

CVE-2021-21660 is a MODERATE (CVSS 5.4) cross-site scripting vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')) affecting Markdown formatter libraries in the Maven ecosystem. The issue involves xss vulnerability in jenkins markdown formatter plugin. Remediation is available by upgrading affected packages to version 0.2.0.

CVE-2021-21660 at a Glance

CVE Identifier CVE-2021-21660
GHSA Identifier GHSA-xqpp-26pp-2365
Severity MODERATE
CVSS v3.1 Base Score 5.4
CWE Classification CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Product Markdown formatter
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 5.4

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required Low (PR:L)
User Interaction Required (UI:R)
Scope Changed (S:C)
Confidentiality Low (C:L)
Integrity Low (I:L)
Availability None (A:N)

How to Fix CVE-2021-21660

To remediate this vulnerability, upgrade all affected Markdown formatter dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

io.jenkins.plugins:markdown-formatter fixed: 0.2.0 
<dependency>
    <groupId>io.jenkins.plugins</groupId>
    <artifactId>markdown-formatter</artifactId>
    <version>0.2.0</version>
</dependency>
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree -Dincludes=io.jenkins.plugins

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2021-21660, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree -Dincludes=io.jenkins.plugins

Analyze the terminal output to locate any version of Markdown formatter in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.2.0), your application is affected.

Note: The mvn dependency:tree -Dincludes=io.jenkins.plugins command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), where the product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. In Markdown formatter, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

Jenkins Markdown Formatter Plugin 0.1.0 and earlier uses a Markdown library to parse Markdown that does not escape crafted link target URLs. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with the ability to edit any description rendered using the configured markup formatter. Jenkins Markdown Formatter Plugin 0.2.0 uses a different Markdown library that is not affected by this problem.

CVE-2021-21660 Affected Markdown formatter Versions

1 component(s)
Fixed Versions:
0.2.0
Product / Package Ecosystem Affected Versions Fixed Version
io.jenkins.plugins:markdown-formatter
maven/io.jenkins.plugins/markdown-formatter
Maven
< 0.2.0
0.2.0

References

NVD — CVE-2021-21660 NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-21660
Security Fix Commit FIX COMMIT
https://github.com/jenkinsci/markdown-formatter-plugin/commit/6b283a5bba3424fd5174b92e7ad8724cdbdf596c
Markdown formatter Source Repository REPOSITORY
https://github.com/jenkinsci/markdown-formatter-plugin
Markdown formatter Security Information SECURITY
https://www.jenkins.io/security/advisory/2021-05-25/#SECURITY-2198
www.whitesourcesoftware.com/vulnerability-datab... WEB
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-21660
Markdown formatter Security Information SECURITY
http://www.openwall.com/lists/oss-security/2021/05/25/3

Frequently Asked Questions

What is CVE-2021-21660?
CVE-2021-21660 is a security vulnerability in Markdown formatter involving XSS vulnerability in Jenkins Markdown Formatter Plugin under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
Which Markdown formatter versions are affected?
Affected versions include releases prior to 0.2.0 across affected packages: io.jenkins.plugins:markdown-formatter.
What version fixes CVE-2021-21660?
Upgrading to 0.2.0 (or the latest patched release for your respective branch) resolves the vulnerability.
Is markdown-formatter affected?
Yes, io.jenkins.plugins:markdown-formatter is affected in releases prior to 0.2.0. Upgrade your dependency to 0.2.0 or later.
What is the CVSS score of CVE-2021-21660?
CVE-2021-21660 has a CVSS v3.1 base score of 5.4 (MODERATE) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
What CWE is associated with CVE-2021-21660?
CVE-2021-21660 is classified under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.).
How can I check Maven dependencies for CVE-2021-21660?
Run the dependency tree command: 'mvn dependency:tree -Dincludes=io.jenkins.plugins'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-xqpp-26pp-2365",
  "modified" : "2023-10-27T14:40:44Z",
  "published" : "2022-05-24T19:03:11Z",
  "aliases" : [ "CVE-2021-21660" ],
  "summary" : "XSS vulnerability in Jenkins Markdown Formatter Plugin",
  "details" : "Jenkins Markdown Formatter Plugin 0.1.0 and earlier uses a Markdown library to parse Markdown that does not escape crafted link target URLs.\n\nThis results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with the ability to edit any description rendered using the configured markup formatter.\n\nJenkins Markdown Formatter Plugin 0.2.0 uses a different Markdown library that is not affected by this problem.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "io.jenkins.plugins:markdown-formatter"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.2.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 0.1.0"
    }
  } ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2021-21660"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/jenkinsci/markdown-formatter-plugin/commit/6b283a5bba3424fd5174b92e7ad8724cdbdf596c"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/jenkinsci/markdown-formatter-plugin"
  }, {
    "type" : "WEB",
    "url" : "https://www.jenkins.io/security/advisory/2021-05-25/#SECURITY-2198"
  }, {
    "type" : "WEB",
    "url" : "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-21660"
  }, {
    "type" : "WEB",
    "url" : "http://www.openwall.com/lists/oss-security/2021/05/25/3"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-79" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2022-12-15T17:32:32Z",
    "nvd_published_at" : "2021-05-25T17:15:00Z"
  }
}