PT-2026-48420 · Jenkins · Jenkins
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Jenkins versions prior to 2.568
Jenkins LTS versions prior to 2.555.3
Description
A deserialization flaw exists in Jenkins due to deficiencies in the XStream library mechanism. By submitting a specially crafted
config.xml file, an attacker can force the system to deserialize arbitrary types defined in the Jenkins core or plugins. This allows the attacker to bypass the ClassFilter (a JEP-200 implementation) by using permitted classes as gadgets, such as hudson.Plugin$DummyImpl.Exploitation enables the attacker to impersonate any user and send HTTP requests on their behalf. This can lead to arbitrary code execution via the Script Console or the unauthorized reading of arbitrary files from the Jenkins controller. Real-world exploitation has been observed against honeypots, targeting CI/CD credentials, pipeline configurations, tokens, and application secrets.
Technical details include the use of the following API endpoints:
/config.xml/createView/view/{ViewName}/properties/0/{file}
Vulnerable parameters include
baseResourceURL within the XML structure, which can be manipulated to access the server's root file system using the file:/ construction via the Stapler framework (a Java framework that maps Java objects to URLs).Recommendations
Update Jenkins to version 2.568 or later.
Update Jenkins LTS to version 2.555.3 or later.
Monitor server logs for suspicious requests to the
/view/{ViewName}/properties/0/{file} endpoint, specifically those targeting sensitive files like /etc/passwd.
Implement IDS/WAF rules to block POST requests to /config.xml or /createView that contain the <hudson.Plugin -DummyImpl> tag and the <baseResourceURL>file:/</baseResourceURL> string.Exploit
Fix
RCE
Deserialization of Untrusted Data
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Jenkins