CVE-2015-8103
published 2015-11-25CVE-2015-8103: The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java…
PriorityP184critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
86.71%
99.7th percentile
The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-*.jar file and the "Groovy variant in 'ysoserial'".
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jenkins | jenkins | < 1.625.2 | 1.625.2 |
| jenkins | jenkins | < 1.638 | 1.638 |
| jenkins | jenkins_core | — | — |
| jenkins | jenkins_lts | — | — |
| redhat | openshift_container_platform | — | — |
| redhat | openshift_container_platform | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect exploitation attempts by monitoring for the HTTP response header 'X-Jenkins-CLI-Port', which the exploit checks to confirm the CLI port is exposed and the target is vulnerable. ↗
- →Monitor for unauthenticated TCP connections to the Jenkins CLI RMI port (discovered via X-Jenkins-CLI-Port header) followed by transmission of a serialized Java stream — this is the exploit delivery channel. ↗
- →Alert on creation of random-named .jar files in /tmp (or the configured TEMP directory) on Jenkins hosts, as the exploit stages a payload JAR to a random filename in that directory. ↗
- →Detect the presence of the vulnerable commons-collections JAR in the Jenkins WEB-INF/lib directory as a configuration/file-integrity indicator. ↗
- →Monitor for outbound connections from Jenkins processes to unexpected hosts on port 4444, consistent with a reverse netcat shell established post-exploitation. ↗
- →Flag Jenkins versions at or below 1.637 (the explicit exploit target) as vulnerable; check the X-Jenkins response header value. ↗
- ·The exploit requires the Jenkins CLI port to be exposed (advertised via the X-Jenkins-CLI-Port HTTP response header). Disabling or firewalling the CLI port removes the primary attack surface. ↗
- ·Authentication is not required to exploit this vulnerability — any network-reachable Jenkins instance with the CLI port open is at risk. ↗
- ·The exploit uses the ysoserial CommonsCollections gadget chain; the vulnerable commons-collections JAR must be present in the Jenkins classpath for exploitation to succeed. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vendor_redhat9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
jenkins: Remote code execution vulnerability due to unsafe deserialization in Jenkins remoting (SECURITY-218)
vendor_redhat·2015-11-11·CVSS 9.8
CVE-2015-8103 [CRITICAL] CWE-502 jenkins: Remote code execution vulnerability due to unsafe deserialization in Jenkins remoting (SECURITY-218)
jenkins: Remote code execution vulnerability due to unsafe deserialization in Jenkins remoting (SECURITY-218)
The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-*.jar file and the "Groovy variant in 'ysoserial'".
Mitigation: https://jenkins-ci.org/content/mitigating-unauthenticated-remote-code-execution-0-day-jenkins-cli
Jenkins
Jenkins Security Advisory 2015-11-11
vendor_jenkins·2015-11-11·CVSS 7.5
CVE-2014-3665 [HIGH] Jenkins Security Advisory 2015-11-11
Title: Jenkins Security Advisory 2015-11-11
Jenkins Security Advisory 2015-11-11
This advisory announces multiple vulnerabilities in Jenkins.
Description
Project name disclosure via fingerprints
SECURITY-153 / CVE-2015-5317
The Jenkins UI allowed users to see the names of jobs and builds otherwise inaccessible to them on the "Fingerprints" pages if those shared file fingerprints with fingerprinted files in accessible jobs.
Public value used for CSRF protection salt
SECURITY-169 / CVE-2015-5318
The salt used to generate the CSRF protection tokens was a publicly accessible value, allowing malicious users to circumvent CSRF protection by generating the correct token.
XXE injection into job configurations via CLI
SECURITY-173 / CVE-20
OSV
Jenkins CLI Deserialization of Untrusted Data vulnerability
osv·2022-05-13
CVE-2015-8103 [CRITICAL] Jenkins CLI Deserialization of Untrusted Data vulnerability
Jenkins CLI Deserialization of Untrusted Data vulnerability
The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic `webapps/ROOT/WEB-INF/lib/commons-collections-*.jar` file and the "Groovy variant in `ysoserial`".
GHSA
Jenkins CLI Deserialization of Untrusted Data vulnerability
ghsa·2022-05-13
CVE-2015-8103 [CRITICAL] CWE-502 Jenkins CLI Deserialization of Untrusted Data vulnerability
Jenkins CLI Deserialization of Untrusted Data vulnerability
The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic `webapps/ROOT/WEB-INF/lib/commons-collections-*.jar` file and the "Groovy variant in `ysoserial`".
No detection rules found.
Exploit-DB
Jenkins CLI - RMI Java Deserialization (Metasploit)
exploitdb·2015-12-15
CVE-2015-8103 Jenkins CLI - RMI Java Deserialization (Metasploit)
Jenkins CLI - RMI Java Deserialization (Metasploit)
---
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class Metasploit3 'Jenkins CLI RMI Java Deserialization Vulnerability',
'Description' => %q{
This module exploits a vulnerability in Jenkins. An unsafe deserialization bug exists on
the Jenkins master, which allows remote arbitrary code execution. Authentication is not
required to exploit this vulnerability.
},
'Author' =>
[
'Christopher Frohoff', # Vulnerability discovery
'Steve Breen', # Public Exploit
'Dev Mohanty', # Metasploit module
'Louis Sato', # Metasploit
'William Vu', # Metasploit
'juan vazquez', # Metasploit
'Wei Chen' # Metasploit
],
'License' => MSF_LICENSE,
'Refe
Metasploit
OpenNMS Java Object Unserialization Remote Code Execution
metasploit
OpenNMS Java Object Unserialization Remote Code Execution
OpenNMS Java Object Unserialization Remote Code Execution
This module exploits a vulnerability in the OpenNMS Java object which allows an unauthenticated attacker to run arbitrary code against the system.
Metasploit
Jenkins-CI Unauthenticated Script-Console Scanner
metasploit
Jenkins-CI Unauthenticated Script-Console Scanner
Jenkins-CI Unauthenticated Script-Console Scanner
This module scans for unauthenticated Jenkins-CI script consoles and executes the specified command.
Metasploit
Jenkins CLI RMI Java Deserialization Vulnerability
metasploit
Jenkins CLI RMI Java Deserialization Vulnerability
Jenkins CLI RMI Java Deserialization Vulnerability
This module exploits a vulnerability in Jenkins. An unsafe deserialization bug exists on the Jenkins master, which allows remote arbitrary code execution. Authentication is not required to exploit this vulnerability.
Recorded Future
Turning Criminal Forum Exploit Chatter Into Vulnerability Risk Analysis
blogs_recorded_future
Turning Criminal Forum Exploit Chatter Into Vulnerability Risk Analysis
# Turning Criminal Forum Exploit Chatter Into Vulnerability Risk Analysis
Editor’s Note: Some of the analysis featured in this article utilizes real-time intelligence from our new Vulnerability Intelligence Cards™. With this summarized data you can assess, prioritize, and remediate vulnerabilities with much greater speed and confidence to reduce your risk. Find out more in the “Threat Intelligence Use Cases” section of our website.
### Key Takeaways
- Recorded Future’s programmatic identification of exploit chatter for vulnerabilities leads to improved remediation prioritization. This prioritization is based on evidence-based assessment of increased adversary intent and/or capabilities.
- Recorded Future’s foreign natural language processing (NLP) adds significant value to vulnerability
Recorded Future
Turning Criminal Forum Exploit Chatter Into Vulnerability Risk Analysis | Recorded Future
blogs_recorded_future
Turning Criminal Forum Exploit Chatter Into Vulnerability Risk Analysis | Recorded Future
## Turning Criminal Forum Exploit Chatter Into Vulnerability Risk Analysis
Editor’s Note : Some of the analysis featured in this article utilizes real-time intelligence from our new Vulnerability Intelligence Cards™. With this summarized data you can assess, prioritize, and remediate vulnerabilities with much greater speed and confidence to reduce your risk. Find out more in the “ Threat Intelligence Use Cases ” section of our website.
## Key Takeaways
Recorded Future’s programmatic identification of exploit chatter for vulnerabilities leads to improved remediation prioritization. This prioritization is based on evidence-based assessment of increased adversary intent and/or capabilities.
Recorded Future’s foreign natural language processing (NLP) adds significant value to vulnerability
arXiv
An In-depth Study of Java Deserialization Remote-Code Execution Exploits and Vulnerabilities
arxiv_fulltext·2022-08-17
An In-depth Study of Java Deserialization Remote-Code Execution Exploits and Vulnerabilities
An In-depth Study of Java Deserialization Remote-Code Execution Exploits and Vulnerabilities
[Imen Sayar]Imen Sayar^
[email protected]
University of Toulouse
Blagnac
France
31070
^ Part of this research was conducted when Imen Sayar was at the University of Luxembourg
[Alexandre Bartel]Alexandre Bartel^*
[email protected]
Umeå University
MIT-Huset
Umeå
Sweden
^*Part of this research was conducted when Alexandre Bartel was at the University of Luxembourg and the University of Copenhagen.
Eric Bodden
[email protected]
Paderborn University
Paderborn
Germany
Yves Le Traon
[email protected]
University of Luxembourg
6, rue Richard Coudenhove-Kalergi
Kirchberg Campus
Luxembourg
L-1359
## Abstract
Nowadays, an increasing number of applications uses deserializatio
Bugzilla
CVE-2015-8103 jenkins: Remote code execution vulnerability due to unsafe deserialization in Jenkins remoting (SECURITY-218)
bugzilla·2015-11-16·CVSS 9.8
CVE-2015-8103 [CRITICAL] CVE-2015-8103 jenkins: Remote code execution vulnerability due to unsafe deserialization in Jenkins remoting (SECURITY-218)
CVE-2015-8103 jenkins: Remote code execution vulnerability due to unsafe deserialization in Jenkins remoting (SECURITY-218)
The following flaw was found in Jenkins:
Unsafe deserialization allows unauthenticated remote attackers to run arbitrary code on the Jenkins master.
This flaw could allow unauthenticated remote attackers to run arbitrary code on Jenkins.
Mitigation:
https://jenkins-ci.org/content/mitigating-unauthenticated-remote-code-execution-0-day-jenkins-cli
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11
Discussion:
Fixed in Fedora in:
jenkins-1.609.3-3.fc22
jenkins-1.625.2-2.fc23
jenkins-1.625.2-2.fc24
---
CVE assignment:
http://seclists.org/oss-sec/2015/q4/307
---
This issue has been addressed in the followin
CWE
Deserialization of Untrusted Data
mitre_cwe
CWE-502 Deserialization of Untrusted Data
CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Background: Serialization and deserialization refer to the process of taking program-internal object-related data, packaging it in a way that allows the data to be externally stored or transferred ("serialization"), then extracting the serialized data to reconstruct the original object ("deserialization").
Modes of Introduction:
Phase: Architecture and Design
Note: OMISSION: This weakness is caused by missing a security tactic during the architecture and design phase.
Phase: Implementation
Common Consequences:
Scope: Integrity. Impact: Modify Application Data, Unexpected State. Attackers can modify unexpected objects or data that was as
CWE
Improper Control of Dynamically-Managed Code Resources
mitre_cwe
CWE-913 Improper Control of Dynamically-Managed Code Resources
CWE-913: Improper Control of Dynamically-Managed Code Resources
The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.
Many languages offer powerful features that allow the programmer to dynamically create or modify existing code, or resources used by code such as variables and objects. While these features can offer significant flexibility and reduce development time, they can be extremely dangerous if attackers can directly influence these code resources in unexpected ways.
Modes of Introduction:
Phase: Architecture and Design
Phase: Implementation
Common Consequences:
Scope: Integrity. Impact: Execute Unauthorized Code or Commands.
Scope
http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/#jenkinshttp://packetstormsecurity.com/files/134805/Jenkins-CLI-RMI-Java-Deserialization.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0489.htmlhttp://www.openwall.com/lists/oss-security/2015/11/09/5http://www.openwall.com/lists/oss-security/2015/11/18/11http://www.openwall.com/lists/oss-security/2015/11/18/13http://www.openwall.com/lists/oss-security/2015/11/18/2http://www.securityfocus.com/bid/77636https://access.redhat.com/errata/RHSA-2016:0070https://jenkins-ci.org/content/mitigating-unauthenticated-remote-code-execution-0-day-jenkins-clihttps://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11https://www.exploit-db.com/exploits/38983/http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/#jenkinshttp://packetstormsecurity.com/files/134805/Jenkins-CLI-RMI-Java-Deserialization.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0489.htmlhttp://www.openwall.com/lists/oss-security/2015/11/09/5http://www.openwall.com/lists/oss-security/2015/11/18/11http://www.openwall.com/lists/oss-security/2015/11/18/13http://www.openwall.com/lists/oss-security/2015/11/18/2http://www.securityfocus.com/bid/77636https://access.redhat.com/errata/RHSA-2016:0070https://jenkins-ci.org/content/mitigating-unauthenticated-remote-code-execution-0-day-jenkins-clihttps://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11https://www.exploit-db.com/exploits/38983/
2015-11-25
Published