module
Jenkins CLI Deserialization
| Disclosed |
|---|
| Apr 26, 2017 |
Disclosed
Apr 26, 2017
Description
An unauthenticated Java object deserialization vulnerability exists
in the CLI component for Jenkins versions `v2.56` and below.
The `readFrom` method within the `Command` class in the Jenkins
CLI remoting component deserializes objects received from clients without
first checking / sanitizing the data. Because of this, a malicious serialized
object contained within a serialized `SignedObject` can be sent to the Jenkins
endpoint to achieve code execution on the target.
in the CLI component for Jenkins versions `v2.56` and below.
The `readFrom` method within the `Command` class in the Jenkins
CLI remoting component deserializes objects received from clients without
first checking / sanitizing the data. Because of this, a malicious serialized
object contained within a serialized `SignedObject` can be sent to the Jenkins
endpoint to achieve code execution on the target.
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.