mirror of
https://github.com/0xMarcio/cve.git
synced 2025-05-29 01:31:01 +00:00
75 lines
3.7 KiB
Markdown
75 lines
3.7 KiB
Markdown
|
### [CVE-2017-1000353](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000353)
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
### Description
|
||
|
|
|
||
|
|
Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthenticated remote code execution vulnerability allowed attackers to transfer a serialized Java `SignedObject` object to the Jenkins CLI, that would be deserialized using a new `ObjectInputStream`, bypassing the existing blacklist-based protection mechanism. We're fixing this issue by adding `SignedObject` to the blacklist. We're also backporting the new HTTP CLI protocol from Jenkins 2.54 to LTS 2.46.2, and deprecating the remoting-based (i.e. Java serialization) CLI protocol, disabling it by default.
|
||
|
|
|
||
|
|
### POC
|
||
|
|
|
||
|
|
#### Reference
|
||
|
|
- http://packetstormsecurity.com/files/159266/Jenkins-2.56-CLI-Deserialization-Code-Execution.html
|
||
|
|
- https://www.exploit-db.com/exploits/41965/
|
||
|
|
- https://www.oracle.com/security-alerts/cpuapr2022.html
|
||
|
|
|
||
|
|
#### Github
|
||
|
|
- https://github.com/0day404/vulnerability-poc
|
||
|
|
- https://github.com/20142995/Goby
|
||
|
|
- https://github.com/20142995/sectool
|
||
|
|
- https://github.com/7roublemaker/Jenkins_check
|
||
|
|
- https://github.com/ARPSyndicate/cvemon
|
||
|
|
- https://github.com/AdeliaNitzsche/Java-Deserialization-Cheat-Sheet
|
||
|
|
- https://github.com/AltTomas/siutn-tp-grupo-2-2018
|
||
|
|
- https://github.com/ArrestX/--POC
|
||
|
|
- https://github.com/BrittanyKuhn/javascript-tutorial
|
||
|
|
- https://github.com/CVEDB/PoC-List
|
||
|
|
- https://github.com/CVEDB/awesome-cve-repo
|
||
|
|
- https://github.com/CVEDB/top
|
||
|
|
- https://github.com/GhostTroops/TOP
|
||
|
|
- https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet
|
||
|
|
- https://github.com/HimmelAward/Goby_POC
|
||
|
|
- https://github.com/JD2344/SecGen_Exploits
|
||
|
|
- https://github.com/KayCHENvip/vulnerability-poc
|
||
|
|
- https://github.com/MelanyRoob/Goby
|
||
|
|
- https://github.com/Miraitowa70/POC-Notes
|
||
|
|
- https://github.com/Mr-xn/Penetration_Testing_POC
|
||
|
|
- https://github.com/N0body007/jenkins-rce-2017-2018-2019
|
||
|
|
- https://github.com/Ostorlab/KEV
|
||
|
|
- https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors
|
||
|
|
- https://github.com/PalindromeLabs/Java-Deserialization-CVEs
|
||
|
|
- https://github.com/SexyBeast233/SecBooks
|
||
|
|
- https://github.com/TheBeastofwar/JenkinsExploit-GUI
|
||
|
|
- https://github.com/Threekiii/Awesome-POC
|
||
|
|
- https://github.com/Threekiii/Vulhub-Reproduce
|
||
|
|
- https://github.com/Z0fhack/Goby_POC
|
||
|
|
- https://github.com/bakery312/Vulhub-Reproduce
|
||
|
|
- https://github.com/cyberanand1337x/bug-bounty-2022
|
||
|
|
- https://github.com/d4n-sec/d4n-sec.github.io
|
||
|
|
- https://github.com/gobysec/Goby
|
||
|
|
- https://github.com/gobysec/Research
|
||
|
|
- https://github.com/hktalent/TOP
|
||
|
|
- https://github.com/hktalent/bug-bounty
|
||
|
|
- https://github.com/huimzjty/vulwiki
|
||
|
|
- https://github.com/jiangsir404/POC-S
|
||
|
|
- https://github.com/klausware/Java-Deserialization-Cheat-Sheet
|
||
|
|
- https://github.com/koutto/jok3r-pocs
|
||
|
|
- https://github.com/lions2012/Penetration_Testing_POC
|
||
|
|
- https://github.com/lnick2023/nicenice
|
||
|
|
- https://github.com/mishmashclone/GrrrDog-Java-Deserialization-Cheat-Sheet
|
||
|
|
- https://github.com/nixawk/labs
|
||
|
|
- https://github.com/oneplus-x/MS17-010
|
||
|
|
- https://github.com/qazbnm456/awesome-cve-poc
|
||
|
|
- https://github.com/r00t4dm/Jenkins-CVE-2017-1000353
|
||
|
|
- https://github.com/reph0r/poc-exp
|
||
|
|
- https://github.com/reph0r/poc-exp-tools
|
||
|
|
- https://github.com/retr0-13/Goby
|
||
|
|
- https://github.com/superfish9/pt
|
||
|
|
- https://github.com/vulhub/CVE-2017-1000353
|
||
|
|
- https://github.com/weeka10/-hktalent-TOP
|
||
|
|
- https://github.com/woods-sega/woodswiki
|
||
|
|
- https://github.com/xbl3/awesome-cve-poc_qazbnm456
|
||
|
|
- https://github.com/xuetusummer/Penetration_Testing_POC
|
||
|
|
|