Update jenkins-script.yaml

patch-1
Prince Chaddha 2022-05-31 14:11:09 +05:30 committed by GitHub
parent ebab53c7be
commit 03993005fb
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 5 additions and 2 deletions

View File

@ -4,7 +4,8 @@ info:
name: Jenkins - Remote Code Execution
author: philippedelteil
severity: critical
description: Jenkins is susceptible to a remote code execution vulnerability due to accessible script functionality.
description: |
Jenkins is susceptible to a remote code execution vulnerability due to accessible script functionality.
reference:
- https://hackerone.com/reports/403402
classification:
@ -18,14 +19,16 @@ requests:
- method: GET
path:
- "{{BaseURL}}/script/"
matchers-condition: and
matchers:
- type: word
part: body
words:
- "println(Jenkins.instance.pluginManager.plugins)"
- "Scriptconsole"
condition: and
part: body
- type: status
status:
- 200