Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update jenkins_script_console.rb to remove deprecated sun.misc.BASE64Decoder class #16750

Merged
merged 5 commits into from Aug 31, 2022
Merged

Update jenkins_script_console.rb to remove deprecated sun.misc.BASE64Decoder class #16750

merged 5 commits into from Aug 31, 2022

Commits on Jul 6, 2022

  1. Update jenkins_script_console.rb 

    Modern Java disabled the sun.misc.BASE64Decoder class so exploit will fail on any newer version of Jenkins.
The java.util.Base64 class should be used now; the change has been confirmed to work with the latest version of Jenkins (the current exploit silently fails).
    @bojanisc
    bojanisc committed Jul 6, 2022
    Configuration menu
    Copy the full SHA
    5db7415 View commit details
    Browse the repository at this point in the history

  2. Update jenkins_script_console.rb

    @bojanisc
    bojanisc committed Jul 6, 2022
    Configuration menu
    Copy the full SHA
    3d13dab View commit details
    Browse the repository at this point in the history

Commits on Aug 25, 2022

  1. Fail back to the old method using error handling 

    Tested successfully on docker image tags:
  * Jenkins 1.565  (pushed 2015-11-14)
  * Jenkins 2.60.3 (pushed 2018-07-17)
Tested unsuccessfully on docker image tags:
  * Jenkins 2.346.3 (pushed 2022-08-10)
    Issue is that login is broken because the URI changed from
    j_acegi_security_check to j_spring_security_check.
    @smcintyre-r7
    smcintyre-r7 committed Aug 25, 2022
    Configuration menu
    Copy the full SHA
    2e8e15e View commit details
    Browse the repository at this point in the history

  2. Switch to using Rex::RandomIdentifier

    @smcintyre-r7
    smcintyre-r7 committed Aug 25, 2022
    Configuration menu
    Copy the full SHA
    8a79128 View commit details
    Browse the repository at this point in the history

  3. Resolve rubocop issues

    @smcintyre-r7
    smcintyre-r7 committed Aug 25, 2022
    Configuration menu
    Copy the full SHA
    324fb69 View commit details
    Browse the repository at this point in the history