Command injection in Jenkins - CVE-2017-1000353

Vulnerability identifier: #VU10657

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-1000353

CWE-ID: CWE-77

Exploitation vector: Remote access

Exploit availability: The vulnerability is being exploited in the wild

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to lack of serialized object validation. A remote attacker can transfer a serialized Java SignedObject object to the remoting-based Jenkins CLI, deserialize it  using a new ObjectInputStream, bypass the existing blacklist-based protection mechanism, inject arbitrary commands and execute arbitrary code with elevated privileges.

Successful exploitation of the vulnerability may result in system compromise.

Jenkins
Oracle Communications Cloud Native Core Automated Test Suite

Update to version 2.57.

• Exploit #4645 - Jenkins CLI Deserialization (September 22, 2020)
• Exploit #183 - labs (Vulnerability Labs for security analysis) (March 18, 2020)
• Exploit #1386 - CloudBees Jenkins 2.32.1 - Java Deserialization (March 18, 2020)

• https://jenkins.io/security/advisory/2017-04-26/

• Remote code execution in Jenkins
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Automated Test Suite