Jenkins Remote Code Execution Vulnerability

Summary

The Jenkins CLI subsystem in CloudBees Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-*.jar file and the ‘Groovy variant in ‘ysoserial”.

Credit:

The information has been provided by Gabriel Lawrence and Chris Frohoff.


Details

Vulnerable Systems:
 * CloudBees Jenkins before 1.638 and LTS before 1.625.2

Immune Systems:
 * CloudBees Jenkins after 1.638 and LTS after 1.625.2

Jenkins is prone to remote code-execution vulnerability. Successfully exploiting this issue allows attackers to execute arbitrary code in the context of the affected application.

CVE Information:
CVE-2015-8103

Disclosure Timeline:
Original release date: 11/25/2015
Last revised: 11/27/2015

Categories: News