high8.8Public exploit code
CVE-2016-0792
Jenkins allows Deserialization of Untrusted Data via an XML File
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Jenkins - XStream Groovy classpath Deserialization (Metasploit)2017-12-19 · remote · multiple · Verified
- Jenkins < 1.650 - Java Deserialization2017-07-30 · remote · java · Verified
Impact
Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.main:jenkins-core | >= 1.643, < 1.650 | 1.650 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Jenkins | through 1.649 through 1.642.1 |
| Redhat | Openshift | Version 3.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://rhn.redhat.com/errata/RHSA-2016-1773.html
- https://access.redhat.com/errata/RHSA-2016:0711
- https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-02-24
- https://www.contrastsecurity.com/security-influencers/serialization-must-die-act-2-xstream
- https://www.exploit-db.com/exploits/42394/
- https://www.exploit-db.com/exploits/43375/
- https://github.com/advisories/GHSA-45rg-g72w-r393
- https://nvd.nist.gov/vuln/detail/CVE-2016-0792
- https://github.com/jenkinsci/jenkins/commit/7f202f0317e60cd3160f61467b8558f864f83f41
- https://www.exploit-db.com/exploits/42394
- https://www.exploit-db.com/exploits/43375