Description
Jenkins存在未经身份验证的远程代码执行漏洞，经过序列化的Java SignedObject对象传输到基于远程处理的Jenkins CLI，在使用新的ObjectInputStream对象对其进行反序列化操作即可绕过现有的基于黑名单的保护机制。攻击者可利用漏洞在受影响的应用程序的上下文中执行任意代码，或造成程序拒绝服务。
Jenkins 存在远程代码执行漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://github.com/cyberharsh/jenkins1000861
https://www.cnblogs.com/jzssuanfa/p/19255187
https://zhuanlan.zhihu.com/p/59793482
https://blog.csdn.net/YouthBelief/article/details/121528843
https://www.modb.pro/db/190089
https://cloud.tencent.com/developer/article/2613028
https://wiki.96.mk/Web%E5%AE%89%E5%85%A8/Jenkins/%EF%BC%88CVE-2017-1000353%EF%BC%89Jenkins-CI%20%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E/
https://www.anquanke.com/post/id/86061
https://krevetk0.medium.com/jenkins-rce-poc-or-simple-pre-auth-remote-code-execution-on-the-server-d18b868a77cb
https://www.upwind.io/feed/jenkins-agents-remote-code-execution-vulnerability-cve-2024-43044
https://www.jenkins.io/security/advisory/2024-01-24/
https://blog.convisoappsec.com/en/analysis-of-cve-2024-43044/