CVE-2015-8103 : The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary co

The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-*.jar file and the "Groovy variant in 'ysoserial'".

Published 2015-11-25 20:59:20

Updated 2024-01-09 02:16:29

Source MITRE

View at NVD, CVE.org

Vulnerability category: Execute code

Threat overview for CVE-2015-8103

Top countries where our scanners detected CVE-2015-8103

Top open port discovered on systems with this issue 8088

IPs affected by CVE-2015-8103 1,877

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2015-8103!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2015-8103

Probability of exploitation activity in the next 30 days: 80.77%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 98 % EPSS Score History EPSS FAQ

Metasploit modules for CVE-2015-8103

Jenkins-CI Unauthenticated Script-Console Scanner

First seen: 2020-04-26

auxiliary/scanner/http/jenkins_command

This module scans for unauthenticated Jenkins-CI script consoles and executes the specified command. Authors: - altonjx - Jeffrey Cap

More information
Jenkins CLI RMI Java Deserialization Vulnerability

Disclosure Date: 2015-11-18

First seen: 2020-04-26

exploit/linux/misc/jenkins_java_deserialize

This module exploits a vulnerability in Jenkins. An unsafe deserialization bug exists on the Jenkins master, which allows remote arbitrary code execution. Authentication is not required to exploit this vulnerability. Authors: - Christopher Frohoff - Steve Breen

More information
OpenNMS Java Object Unserialization Remote Code Execution

Disclosure Date: 2015-11-06

First seen: 2020-04-26

exploit/linux/misc/opennms_java_serialize

This module exploits a vulnerability in the OpenNMS Java object which allows an unauthenticated attacker to run arbitrary code against the system. Authors: - Ben Turner <benpturner@yahoo.com>

More information

CVSS scores for CVE-2015-8103

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P	10.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2015-8103

CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Assigned by: nvd@nist.gov (Primary)
CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2015-8103

https://jenkins-ci.org/content/mitigating-unauthenticated-remote-code-execution-0-day-jenkins-cli

Mitigating unauthenticated remote code execution 0-day in Jenkins CLI
Exploit
http://www.openwall.com/lists/oss-security/2015/11/18/2

oss-security - Re: CVE request: Jenkins remote code execution vulnerability due to unsafe deserialization
Mailing List
http://www.openwall.com/lists/oss-security/2015/11/18/13

oss-security - Re: CVE request: Jenkins remote code execution vulnerability due to unsafe deserialization
Mailing List
https://access.redhat.com/errata/RHSA-2016:0070

RHSA-2016:0070 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/#jenkins

What Do WebLogic, WebSphere, JBoss, Jenkins, OpenNMS, and Your Application Have in Common? This Vulnerability.
Exploit
https://www.exploit-db.com/exploits/38983/

Jenkins CLI - RMI Java Deserialization (Metasploit)
Exploit;Third Party Advisory;VDB Entry
http://www.securityfocus.com/bid/77636

Jenkins CVE-2015-8103 Remote Code Execution Vulnerability
Broken Link
http://rhn.redhat.com/errata/RHSA-2016-0489.html

RHSA-2016:0489 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
http://www.openwall.com/lists/oss-security/2015/11/09/5

oss-security - CVE request: Jenkins remote code execution vulnerability due to unsafe deserialization
Mailing List
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11

Jenkins Security Advisory 2015-11-11 - Security Advisories - Jenkins Wiki
Vendor Advisory

CVEs referencing this url
http://www.openwall.com/lists/oss-security/2015/11/18/11

oss-security - Re: Re: CVE request: Jenkins remote code execution vulnerability due to unsafe deserialization
Mailing List
http://packetstormsecurity.com/files/134805/Jenkins-CLI-RMI-Java-Deserialization.html

Jenkins CLI RMI Java Deserialization ≈ Packet Storm
Exploit;Third Party Advisory;VDB Entry

Products affected by CVE-2015-8103

Redhat » Openshift Container Platform » Version: 3.1
cpe:2.3:a:redhat:openshift_container_platform:3.1:*:*:*:*:*:*:*
Matching versions
Redhat » Openshift Container Platform » Version: 2.2
cpe:2.3:a:redhat:openshift_container_platform:2.2:*:*:*:*:*:*:*
Matching versions
Jenkins » Jenkins
Versions before (<) 1.638
cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*
Matching versions
Jenkins » Jenkins » LTS Edition
Versions before (<) 1.625.2
cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*
Matching versions

Vulnerability Details : CVE-2015-8103