Jenkins 2.56 CLI Deserialization / Code Execution
Posted by deepcore on September 23, 2020 – 11:45 am
An unauthenticated Java object deserialization vulnerability exists in the CLI component for Jenkins versions 2.56 and below. The readFrom method within the Command class in the Jenkins CLI remoting component deserializes objects received from clients without first checking / sanitizing the data. Because of this, a malicious serialized object contained within a serialized SignedObject can be sent to the Jenkins endpoint to achieve code execution on the target.
Post a reply
You must be logged in to post a comment.