Listen to this Post
How the mentioned CVE works:
An unauthenticated attacker can exploit this vulnerability by sending a specially crafted serialized Java `SignedObject` to the Jenkins server’s CLI port. The `SignedObject` is a carrier for other serialized objects. When Jenkins receives this object, it deserializes it using a new ObjectInputStream, which completely bypasses the existing deserialization blacklist designed to prevent such attacks. The `SignedObject` itself is not on the blacklist, acting as a Trojan horse to deliver a malicious payload. During deserialization, the encapsulated malicious code is executed, granting the attacker remote code execution on the server with the privileges of the Jenkins process, all without requiring authentication.
Platform: Jenkins
Version: <=2.56, <=2.46.1
Vulnerability: Deserialization RCE
Severity: Critical
date: 2017-04-26
Prediction: Patch released.
What Undercode Say:
curl http://jenkins-host:port/cli
SignedObject so = (SignedObject) in.readObject(); so.getObject(); // Triggers deserialization
java -jar jenkins-cli.jar -s http://vulnerable-host/ connect-node < /tmp/malicious.ser
How Exploit:
Sends serialized `SignedObject` payload via CLI protocol to execute system commands.
Protection from this CVE:
Update Jenkins immediately. Apply vendor patch. Disable CLI protocol.
Impact:
Full system compromise. Unauthenticated remote code execution.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: www.cve.org
Extra Source Hub:
Undercode
