CVE-2017-1000353
Jenkins Remote Code Execution Vulnerability
Description
CVE-2017-1000353 is a critical deserialization of untrusted data vulnerability in Jenkins, the widely used open-source automation server. Jenkins versions 2.56 and earlier, as well as Jenkins LTS versions 2.46.1 and earlier, are vulnerable to unauthenticated remote code execution through the Jenkins CLI. An attacker can transfer a serialized Java SignedObject to the CLI interface, which bypasses the existing blacklist-based deserialization protection mechanism when deserialized using a new ObjectInputStream. With a CVSS v3.1 base score of 9.8 and an EPSS score of 94.51% at the 100th percentile, CVE-2017-1000353 is one of the most actively exploited Jenkins vulnerabilities, posing an immediate threat to CI/CD infrastructure security.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| jenkins | jenkins | <= 2.56; <= 2.46.1 |
| oracle | communications cloud native core automated test suite | 1.9.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/159266/Jenkins-2.56-CLI-Deserialization-Code-Execution.html(Permissions Required, Third Party Advisory, VDB Entry)
- http://www.securityfocus.com/bid/98056(Broken Link)
- https://jenkins.io/security/advisory/2017-04-26/(Vendor Advisory)
- https://www.exploit-db.com/exploits/41965/(Exploit, Third Party Advisory, VDB Entry)
- https://www.oracle.com/security-alerts/cpuapr2022.html(Patch, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-1000353(US Government Resource)
Weakness Type
CWE-502: Deserialization of Untrusted Data
CVE-2017-1000353 is classified under CWE-502 (Deserialization of Untrusted Data), which occurs when an application deserializes data from an untrusted source without sufficient verification. In the Jenkins CLI, serialized Java objects are received from unauthenticated remote clients and deserialized using a new ObjectInputStream. By crafting a serialized SignedObject that encapsulates a malicious payload, an attacker bypasses the existing deserialization blacklist, achieving arbitrary code execution on the Jenkins server.
Learn more: CWE-502 — Deserialization of Untrusted Data
Impact Analysis
CVE-2017-1000353 represents a maximum-severity threat to Jenkins infrastructure. The vulnerability is remotely exploitable over the network (AV:N) with low attack complexity (AC:L), requiring no authentication (PR:N) and no user interaction (UI:N). Confidentiality (High): An attacker achieving code execution on a Jenkins server can access all build configurations, stored credentials, source code repositories, deployment keys, and secrets managed by Jenkins. CI/CD servers typically hold the most sensitive credentials in an organization. Integrity (High): Code execution on Jenkins allows modification of build pipelines, injection of malicious code into software deployments, and tampering with artifacts, enabling devastating supply chain attacks. Availability (High): The attacker can disrupt all CI/CD operations, destroy build history, and prevent software deployments. With a CVSS score of 9.8 (Critical) and an EPSS score of 94.51% at the 100th percentile, this Jenkins deserialization vulnerability presents the highest possible exploitation risk to any organization running unpatched Jenkins instances.
Exploit Maturity
CVE-2017-1000353 exhibits maximum exploit maturity. Public exploit code is available via Exploit-DB entry 41965, and a Packet Storm Security exploit provides additional proof-of-concept code. CISA has confirmed active exploitation by adding this vulnerability to the Known Exploited Vulnerabilities catalog. The EPSS score of 94.51% at the 100th percentile represents the absolute maximum exploitation probability, indicating that this is among the most exploited vulnerabilities ever tracked. The availability of ready-to-use exploit tools combined with the unauthenticated nature of the attack makes this vulnerability trivially exploitable by even low-skilled attackers. Jenkins instances are frequently exposed to the internet for distributed build operations, significantly expanding the attack surface.
Remediation
-
Upgrade Jenkins immediately. Update to Jenkins version 2.57 or later, or Jenkins LTS version 2.46.2 or later. The fix adds SignedObject to the deserialization blacklist and backports the HTTP CLI protocol from Jenkins 2.54, deprecating the remoting-based (Java serialization) CLI protocol. The CISA required action states to apply mitigations per vendor instructions or discontinue use of the product.
-
Disable the Jenkins CLI remoting protocol. In the Jenkins global security configuration, disable the CLI over Remoting protocol. The new HTTP CLI protocol does not use Java serialization and is not vulnerable to this class of attack. This can serve as an immediate mitigation even before full upgrade.
-
Restrict network access to Jenkins. Ensure Jenkins is not directly exposed to the internet. Place Jenkins behind a VPN or reverse proxy with authentication. Implement IP-based access controls to limit which networks can reach the Jenkins instance, particularly the CLI endpoints.
-
Audit Jenkins for signs of compromise. Review Jenkins system logs for unusual CLI connections, unexpected job executions, and modifications to build configurations or credentials. Check for unauthorized plugins, new admin accounts, and changes to security settings. Jenkins servers managing deployment pipelines should be treated as potentially compromised if they were running vulnerable versions while exposed to untrusted networks.
-
Implement deserialization hardening. As a long-term measure, review and restrict the Jenkins deserialization allowlist. Minimize the number of plugins installed to reduce the available gadget chain surface. Consider migrating to Jenkins configurations that use HTTPS and certificate-based authentication for all CLI and agent communications.
Technical Details
CVE-2017-1000353 is a deserialization of untrusted data vulnerability in the Jenkins CLI subsystem. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H confirms that the vulnerability is exploitable remotely without authentication or user interaction, with maximum impact on confidentiality, integrity, and availability. The root cause is CWE-502 (Deserialization of Untrusted Data). Jenkins maintained a blacklist of dangerous Java classes to prevent deserialization attacks against the CLI. However, the attacker can wrap a malicious serialized object inside a Java SignedObject, which was not included in the blacklist. When the CLI processes the incoming serialized data, it creates a new ObjectInputStream to deserialize the SignedObject's content, bypassing the blacklist check entirely. The deserialized payload triggers a gadget chain that achieves arbitrary code execution on the Jenkins server. The fix addresses this by adding SignedObject to the blacklist and transitioning the CLI from the remoting-based protocol (which relies on Java serialization) to an HTTP-based protocol. Affected products include Jenkins versions up to 2.56 and Jenkins LTS versions up to 2.46.1, as well as Oracle Communications Cloud Native Core Automated Test Suite 1.9.0.
Frequently Asked Questions
Is CVE-2017-1000353 being actively exploited?
Yes. CISA has confirmed active exploitation by adding CVE-2017-1000353 to the Known Exploited Vulnerabilities catalog. The EPSS score of 94.51% at the 100th percentile is the maximum possible, indicating this is among the most actively exploited vulnerabilities tracked. Public exploit code is readily available.
What products are affected by CVE-2017-1000353?
Jenkins versions 2.56 and earlier and Jenkins LTS versions 2.46.1 and earlier are affected. Additionally, Oracle Communications Cloud Native Core Automated Test Suite version 1.9.0 is affected. Any organization running these versions with the CLI accessible over the network is at risk.
How do I fix CVE-2017-1000353?
Upgrade to Jenkins 2.57+ or Jenkins LTS 2.46.2+. As an immediate mitigation, disable the CLI over Remoting protocol in Jenkins global security settings. Restrict network access to Jenkins, especially the CLI endpoints, and ensure Jenkins is not directly exposed to the internet.
How severe is CVE-2017-1000353?
CVE-2017-1000353 is rated Critical with a CVSS v3.1 base score of 9.8 out of 10. It allows unauthenticated remote code execution on Jenkins servers. The EPSS score of 94.51% at the 100th percentile confirms it is one of the most exploited vulnerabilities in existence, with ready-to-use exploits publicly available.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.