Entreprise française de cybersécurité depuis 2004
☎ 03 60 47 09 81 - info@securiteinfo.com

CVE-2016-9299

Description

The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Java object, which triggers an LDAP query to a third-party server.

POC

Reference

- http://www.slideshare.net/codewhitesec/java-deserialization-vulnerabilities-the-forgotten-bug-class-deepsec-edition

- https://groups.google.com/forum/#!original/jenkinsci-advisories/-fc-w9tNEJE/GRvEzWoJBgAJ

- https://www.cloudbees.com/jenkins-security-advisory-2016-11-16

- https://www.exploit-db.com/exploits/44642/

Github

- https://github.com/20142995/nuclei-templates

- https://github.com/ARPSyndicate/cve-scores

- https://github.com/ARPSyndicate/cvemon

- https://github.com/AdeliaNitzsche/Java-Deserialization-Cheat-Sheet

- https://github.com/BrittanyKuhn/javascript-tutorial

- https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet

- https://github.com/PalindromeLabs/Java-Deserialization-CVEs

- https://github.com/TheBeastofwar/JenkinsExploit-GUI

- https://github.com/cyb3r-w0lf/nuclei-template-collection

- https://github.com/klausware/Java-Deserialization-Cheat-Sheet

- https://github.com/mandiant/heyserial

- https://github.com/mishmashclone/GrrrDog-Java-Deserialization-Cheat-Sheet

- https://github.com/r00t4dm/Jenkins-CVE-2016-9299

- https://github.com/superfish9/pt