$5000 Bounty | Remote Code Execution via Script | Bug Bounty POC | Live Recon Bug Bounty Methodology
-----------------------------------------------------------------------
Twitter: / abhishekmorla
Website: https://abhishekmorla.netlify.app/
Linkedin: / abhishekmorla
------------------------------------------------------------------------
use the below dork to find Jenkins dashboard
"X-Jenkins" "Set-Cookie: JSESSIONID" http.title:"Dashboard" 200 OK
why and where the vulnerability is?
/ a-case-study-on-jenkins-rce
The vulnerability in CVE-2019-1003000 was located in the Jenkins core, the central component of the Jenkins platform. Specifically, the vulnerability was caused by improper handling of form submission requests.
Form submission requests are used to send data to the server when a user fills out and submits a form on a web page. In the case of Jenkins, form submission requests are used to send data to the server when a user performs specific actions, such as configuring a building job or creating a new user.
The vulnerability allowed an attacker to send a maliciously crafted form submission request to the Jenkins server, which could then be used to execute arbitrary code on the server.
How to exploit
https://gist.github.com/frohoff/fed1f...