#VU10657 Command injection in Jenkins - CVE-2017-1000353

Vulnerability identifier: #VU10657

Vulnerability risk: High

CVSSv4.0: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Amber]

CVE-ID: CVE-2017-1000353

CWE-ID: CWE-77

Exploitation vector: Network

Exploit availability: Yes

Vulnerable software:
Jenkins
Server applications / Application servers

Vendor: Jenkins

Description
The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to lack of serialized object validation. A remote attacker can transfer a serialized Java SignedObject object to the remoting-based Jenkins CLI, deserialize it  using a new ObjectInputStream, bypass the existing blacklist-based protection mechanism, inject arbitrary commands and execute arbitrary code with elevated privileges.

Successful exploitation of the vulnerability may result in system compromise.

Mitigation
Update to version 2.57.

Vulnerable software versions

Jenkins: 2.31 - 240

---

External links
https://jenkins.io/security/advisory/2017-04-26/

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, a fully functional exploit for this vulnerability is available.