All Articles

Page 3 of 4
Tech Editorials #Advisory #CVE #RCE

Hacking Jenkins Part 2 - Abusing Meta Programming for Unauthenticated RCE!(EN)



After Jenkins released the [Security Advisory]( and fixed the dynamic routing vulnerability on 2018-12-05, I started to organize my notes in order to write this Hacking Jenkins series. While reviewing notes, I found another exploitation way on a gadget that I failed to exploit before! Therefore, the part two is the story for that! This is also one of my favorite exploits and is really worth reading :)

Tech Editorials #Advisory #CVE #infoleak #SSRF

Hacking Jenkins Part 1 - Play with Dynamic Routing (EN)



This article is mainly about a brief security review on Jenkins in the last year. During this review, we found 5 vulnerabilities including: CVE-2018-1999002(Arbitrary file read vulnerability), CVE-2018-1000600(CSRF and missing permission checks in GitHub Plugin), CVE-2018-1999046(Unauthorized users could access agent logs), CVE-2018-1000861(Code execution through crafted URLs), CVE-2019-pending(Sandbox Bypass in Script Security and Pipeline Plugins)