Executive brief
Jenkins is a popular automation server used by software teams to build and deploy code. A critical security flaw in its communication module allows an unauthenticated attacker to take full control of the server. By sending a specially crafted message, an attacker can force the server to execute malicious code, potentially leading to data theft or complete system compromise.
Technical details
A remote code execution (RCE) vulnerability exists in the Jenkins remoting module due to unsafe Java deserialization. An unauthenticated attacker can send a crafted serialized Java object to the Jenkins CLI or remoting port. This object triggers an LDAP query to an attacker-controlled third-party server, which then returns a malicious payload that bypasses existing protection mechanisms to execute arbitrary code on the Jenkins master. The issue is tracked by the vendor as SECURITY-360 and was patched in Jenkins 2.32, LTS 2.19.3, and remoting module 2.62.3.
Affected products
- Jenkins Jenkins before 2.32, LTS before 2.19.3
- Jenkins remoting module before 2.62.3
Timeline
- 2016-11-13: disclosed: Vulnerability disclosed to oss-security mailing list
- 2016-11-14: other: CVE-2016-9299 assigned
- 2016-11-16: patched: Jenkins security advisory and fixes released
- 2017-01-12: advisory: NVD publication date
References
- http://www.openwall.com/lists/oss-security/2016/11/12/4
- http://www.openwall.com/lists/oss-security/2016/11/14/9
- http://www.securityfocus.com/bid/94281
- http://www.slideshare.net/codewhitesec/java-deserialization-vulnerabilities-the-forgotten-bug-class-deepsec-edition
- https://groups.google.com/forum/
- https://groups.google.com/forum/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZW2KUKYLNLVDB7STLHLYALCUFLEGCRM6/