JENKINS UNAUTHENTICATED REMOTE CODE EXECUTION

[Aurelien Ryo]

Hello,

We are using Jenkins as service on windows server (I'm was not agree...).

I have followed process https://jenkins.io/blog/2015/11/06/mitigating-unauthenticated-remote-code-execution-0-day-in-jenkins-cli/ 

I executed the script into the script console on URL http://mywebsite/script with succes. Next step specified it's to add the script in $JENKINS_HOME/init.groovy.d/cli-shutdown.groovy , but I don't have folder "init.groovy.d" in my windows directory.

Do you know how can I process on windows server to force the script on jenkins restart ?

Thanks in advance

Aurélien

[Daniel Beck]

> On 17.11.2016, at 17:53, Aurelien Ryo <aurel...@gmail.com> wrote:
>
> I don't have folder "init.groovy.d" in my windows directory.

Just create it.

[Aurelien Ryo]

Hi Daniel,

I can create the folder, but are you sure it will be started automaticaly on windows service start ?

Thanks

[Daniel Beck]

> On 18.11.2016, at 09:36, Aurelien Ryo <aurel...@gmail.com> wrote:
>
> I can create the folder, but are you sure it will be started automaticaly on windows service start ?

Yes. It also gets logged to the Jenkins log so you can confirm it works there. Look for the following after a Jenkins restart:

jenkins.util.groovy.GroovyHookScript execute

The line below it will tell you that the Groovy script got executed.

[Aurelien Ryo]

Hi Daniel,

I have created the folder init.groovy.d and copied the file into, but after restart I can't find "jenkins.util.groovy.GroovyHookScript execute " in the jenkins log, even un full log. I also tried to upload the script in Scriptler.

Any idea ?

Thanks in advance

Aurélien

[Daniel Beck]

Which version of Jenkins is this? What is the full path to the groovy file, including its file name?

[Aurelien Ryo]

Daniel,

We have version 1.642.2, the full path of the script is E:\build_server\jenkins\scriptler\scripts\cli-shutdown.groovy.

Thanks in advance

Aurélien

[Aurelien Ryo]

Nobody have any idea ?

[Daniel Beck]

Repeating my previous response that I accidentally sent to you directly…

----

>
> On 18.11.2016, at 17:04, Aurelien Ryo <aurel...@gmail.com> wrote:
>
> the full path of the script is E:\build_server\jenkins\scriptler\scripts\cli-shutdown.groovy

That's not the path you should use.

https://github.com/jenkinsci-cert/SECURITY-218 explains how this works. Please read it again.

[Aurelien Ryo]

Hi Daniel,

I created $JENKINS_HOME/init.groovy.d/cli-shutdown.groovy but it not works.

Aurélien