Vulnerability & Exploit Database

Back to search

Jenkins XStream Groovy classpath Deserialization Vulnerability

This module exploits CVE-2016-0792 a vulnerability in Jenkins versions older than 1.650 and Jenkins LTS versions older than 1.642.2 which is caused by unsafe deserialization in XStream with Groovy in the classpath, which allows remote arbitrary code execution. The issue affects default installations. Authentication is not required to exploit the vulnerability.

Free Metasploit Download

Get your copy of the world's leading penetration testing tool

 Download Now

Module Name

exploit/multi/http/jenkins_xstream_deserialize

Authors

  • Arshan Dabirsiaghi
  • Matt Byrne <attackdebris [at] gmail.com>

References

Targets

  • Unix (In-Memory)
  • Python (In-Memory)
  • Linux (Dropper)
  • Windows (Dropper)

Platforms

  • windows
  • linux
  • unix
  • python

Architectures

  • cmd
  • python
  • x86
  • x64
  • cmd
  • python
  • x86, x64

Reliability

Development

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use exploit/multi/http/jenkins_xstream_deserialize msf exploit(jenkins_xstream_deserialize) > show targets ...targets... msf exploit(jenkins_xstream_deserialize) > set TARGET <target-id> msf exploit(jenkins_xstream_deserialize) > show options ...show and set options... msf exploit(jenkins_xstream_deserialize) > exploit

Related Vulnerabilities