978c16266a
9 changes to exploits/shellcodes Microsoft Font Subsetting - DLL Heap Corruption in ComputeFormat4CmapData SNMPc Enterprise Edition 9/10 - Mapping Filename Buffer Overflow Microsoft Windows 10.0.17134.648 - HTTP -> SMB NTLM Reflection Leads to Privilege Elevation Xymon 4.3.25 - useradm Command Execution (Metasploit) Tenda D301 v2 Modem Router - Persistent Cross-Site Scripting MyT Project Management 1.5.1 - User[username] Persistent Cross-Site Scripting Sahi Pro 8.0.0 - Remote Command Execution Jenkins Dependency Graph View Plugin 0.13 - Persistent Cross-Site Scripting Citrix SD-WAN Appliance 10.2.2 - Authentication Bypass / Remote Command Execution Linux/x86 - chmod 666 /etc/passwd & chmod 666 /etc/shadow Shellcode (61 bytes)
39 lines
No EOL
1.4 KiB
Text
39 lines
No EOL
1.4 KiB
Text
# Exploit Title: Persistent XSS - Dependency Graph View Plugin(v0.13)
|
|
# Vendor Homepage: https://wiki.jenkins.io/display/JENKINS/Dependency+Graph+View+Plugin
|
|
# Exploit Author: Ishaq Mohammed
|
|
# Contact: https://twitter.com/security_prince
|
|
# Website: https://about.me/security-prince
|
|
# Category: webapps
|
|
# Platform: Java
|
|
# CVE: CVE-2019-10349
|
|
# Jenkins issue: #SECURITY-1177
|
|
|
|
1. Description:
|
|
The "Display Name" field in General Options of the Configure module in
|
|
Jenkins was found to be accepting arbitrary value which when loaded in the
|
|
Dependency Graph View module gets execute which makes it vulnerable to a
|
|
Stored/Persistent XSS.
|
|
|
|
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10349
|
|
2. Proof of Concept:
|
|
Vulnerable Source
|
|
http://{jenkins-hostname:port}/jobs/{projectname}/configure
|
|
Steps to Reproduce:
|
|
Login to Jenkins Server with valid credentials and ensure that the
|
|
dependency graph plugin is installed.
|
|
1. Click on configure the Jenkins plugin.
|
|
2. Select advanced options
|
|
3. Enter the XSS payload in the "Display Name" field
|
|
4. Navigate to Dependency Graph module
|
|
5. Observe the Executed Payload
|
|
6. Payload used for the demo:
|
|
|
|
<img src="a" onerror="alert('jenkinsxss')">
|
|
|
|
3. Solution:
|
|
As of publication of this advisory, there is no fix.
|
|
The plugin hsa been abandoned by the maintainer
|
|
|
|
|
|
Reference
|
|
https://jenkins.io/security/advisory/2019-07-11/#SECURITY-1177 |