SECURITY-3430

SECURITY-3430 变通方案 这是一个 Java 代理，用于尚未修复 SECURITY-3430 的 Jenkins 控制器（即版本至 2.470 及 LTS 2.452.3 及以下）。 机制与兼容性 它通过变换包含 SECURITY-3430 漏洞的类的定义来阻止利用。 如果因某种原因失败，Jenkins 将被强制停止 。 此变通方案将完全阻止 ClassLoaderProxyfetchJar，因此与安全公告中提到的受影响的插件功能不兼容，这一点与常规修复不同。 该变通方案已在过去几年的多个 Jenkins 版本上成功测试。 警告：鉴于本变通方案的工作原理，我们强烈建议您定期备...

CVE-2024-43044-POC

用法 通过http://ip:port/jnlpJars/agent.jar下载jar包 修改\hudson\remoting\RemoteClassLoader.class对应代码 重新编译打包 需提前获悉node的密钥和名称 root@kitploit: java -jar agent.jar -url http://ip:port/ -secret -name 添加内容为： root@kitploit: import java.util.Scanner; try Scanner scanner = new ScannerSystem.in;...

jenkins: Arbitrary file read vulnerability through agent connections can lead to RCE

A vulnerability was found in the Remoting library in Jenkins core, which handles communication between the Jenkins controller and agents. The ClassLoaderProxyfetchJar function may allow malicious agents or attackers with Agent/Connect permission to read arbitrary files from the Jenkins controller...

jenkins: Arbitrary file read vulnerability through agent connections can lead to RCE

A vulnerability was found in the Remoting library in Jenkins core, which handles communication between the Jenkins controller and agents. The ClassLoaderProxyfetchJar function may allow malicious agents or attackers with Agent/Connect permission to read arbitrary files from the Jenkins controller...

CVE-2024-43044

A vulnerability was found in the Remoting library in Jenkins core, which handles communication between the Jenkins controller and agents. The ClassLoaderProxyfetchJar function may allow malicious agents or attackers with Agent/Connect permission to read arbitrary files from the Jenkins controller...

GHSA-H856-FFVV-XVR4 Jenkins Remoting library arbitrary file read vulnerability

Jenkins uses the Remoting library typically agent.jar or remoting.jar for the communication between controller and agents. This library allows agents to load classes and classloader resources from the controller, so that Java objects sent from the controller build steps, etc. can be executed on...

PT-2024-5496 · Jenkins +2 · Jenkins +2

Name of the Vulnerable Software and Affected Versions: Jenkins versions 2.470 and earlier, LTS versions 2.452.3 and earlier Description: A critical issue in Jenkins allows agent processes to read arbitrary files from the Jenkins controller file system by using the ClassLoaderProxyfetchJar method ...