Web Server Jenkins HTTP CLI RCE

Jenkins versions 1.4 - 2.46.1 and 2.5 - 2.56 are vulnerable to unauthenticated remote code execution (RCE) through the Jenkins remoting CLI. Attackers are able to bypass blacklist-based protections by including a Java 'SignedObject' to common deserialization gadgets, which leads to RCE when passed to a Java ObjectInputStream.

Exploitation

Stages

1. The attacker sends an empty HTTP POST request with Side:download and Session HTTP headers to the vulnerable Jenkins server.
2. The attacker sends an HTTP POST request with Side:upload and the same Session ID in the HTTP headers to the vulnerable server. The request contains a serialized java ‘SignedObject’ object.
3. The server sends an HTTP 200 OK in response to the Side:download request (1). The response contains a serialized Java Hudson response object preceded by a string that indicates compromise.
4. The server sends an empty HTTP 200 OK in response to the Side:upload request (2).

Prerequisites

The attacker can access and exploit the Jenkins CLI remotely and without authentication.

Alert Logic Coverage

Alert Logic® has evaluated its customer base for exposure to the exploit and has developed signatures for mitigating the threat depending on the security service in place.

The Network-Based Intrusion Detection System (IDS) has been updated with the new signatures for this exploit when detected via Alert Logic Threat Manager™. If this signature is detected, an incident is generated in the Alert Logic console.

Detection of this threat is provided via Alert Logic ActiveWatch for Web Security Manager service. Depending on your deployment of Web Security Manager, you will receive an incident (for out-of-band deployment) or the threat will be actively blocked and rejected (for the inline Web Security Manager Premier deployment) if an exploit attempt is observed.

Recommendations for Mitigation

Upgrade to a non-vulnerable version to mitigate this vulnerability.