exploit the possibilities

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Showing 1 - 1 of 1

Files from SSD

Jenkins 2.56 CLI Deserialization / Code Execution

Posted Sep 22, 2020

Authored by Shelby Pace, SSD | Site metasploit.com

An unauthenticated Java object deserialization vulnerability exists in the CLI component for Jenkins versions 2.56 and below. The readFrom method within the Command class in the Jenkins CLI remoting component deserializes objects received from clients without first checking / sanitizing the data. Because of this, a malicious serialized object contained within a serialized SignedObject can be sent to the Jenkins endpoint to achieve code execution on the target.

tags | exploit, java, code execution

advisories | CVE-2017-1000353

SHA-256 | 3729c358cb302e4f78e19a3ad5a83bfe54ed6e185ea35041abb6038c065373da

Download | Favorite | View