Jenkins安全漏洞CVE-2015-5323概念验证与利用分析

本文详细分析了Jenkins的SECURITY-200漏洞（CVE-2015-5323），该漏洞允许管理员默认获取其他用户的API令牌，并在特定权限配置下使用其他用户凭证执行脚本。文章包含受影响版本范围和Groovy脚本控制台的概念验证代码示例。

Jenkins - SECURITY-200 / CVE-2015-5323 PoC

API tokens of other users available to admins

SECURITY-200 / CVE-2015-5323

API tokens of other users were exposed to admins by default. On instances that don’t implicitly grant RunScripts permission to admins, this allowed admins to run scripts with another user’s credentials.

受影响版本

All Jenkins main line releases up to and including 1.637
All Jenkins LTS releases up to and including 1.625.1

PoC

Tested against Jenkins 1.6.37

From the script console:

1
2
3
4
5


// run some groovy code to get the token of another user

// wrong token

// correct token

标签 devops, jenkins, Pentesting