Hacking Jenkins
summary
Finds and chains together a dynamic URL-loading ACL bypass and Groovy meta-programming to achieve a full pre-auth RCE. Uses Stapler’s dynamic routing to traverse objects, abuses Java reflection and Groovy annotations (@ASTTest, @Grab), hosts a malicious JAR and triggers it via the pipeline runner service constructor to execute code (demo succeeds). Reports 7 CVEs, releases an exploit repo, and estimates about 45,000 Jenkins instances remain vulnerable before fixes in December/January.
AI-written summary · about
chapters (19)
- 0:00Intro
- 0:47Orange Tsai
- 1:24Outline
- 3:30JVM ecosystem report 2018
- 3:45Jenkins for hackers
- 5:37Common attack vectors
- 6:34Past deserialization bugs on Jenkins
- 7:26Jenkins remoting 2.55
- 9:34Review Java web
- 10:03What did Stapler do?
- 11:29Routing rules
- 15:12URL whitelists by default
- 24:19compile-time Meta-Programming
- 27:31Root cause analysis
- 30:52Prepare the malicious JAR
- 31:30Attacking remote Jenkins!
- 33:53Survey on Shodan
- 34:50Evolution of the exploit
- 36:28More reliable exploit chain
related talks
35mHow To Find The Next Great Deserialization CVE
11mIdentifying Security Vulnerabilities at Scale: Venture Inside a Pipeline
01h 06mLive hacking: Breaking into your Java web app
46mLive hacking: Breaking into your Java web app
40mLive hacking: Breaking into your web app
43mLive hacking: Breaking into your Java web app
45mLive Hacking Cloud Architectures
34mAbuse of Repository Webhooks to Access Hundreds of Internal CI Systems