CVEs-PoC/2018/CVE-2018-1999002.md

CVE-2018-1999002

Description

A arbitrary file read vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers to send crafted HTTP requests returning the contents of any file on the Jenkins master file system that the Jenkins master has access to.

POC

Reference

• https://www.exploit-db.com/exploits/46453/
• https://www.oracle.com/security-alerts/cpuapr2022.html

Github

• https://github.com/0x6b7966/CVE-2018-1999002
• https://github.com/0xT11/CVE-POC
• https://github.com/0xtavian/CVE-2019-1003000-and-CVE-2018-1999002-Pre-Auth-RCE-Jenkins
• https://github.com/ARPSyndicate/cvemon
• https://github.com/Awrrays/FrameVul
• https://github.com/CVEDB/PoC-List
• https://github.com/CVEDB/awesome-cve-repo
• https://github.com/CVEDB/top
• https://github.com/GhostTroops/TOP
• https://github.com/JERRY123S/all-poc
• https://github.com/TheBeastofwar/JenkinsExploit-GUI
• https://github.com/ZTK-009/RedTeamer
• https://github.com/cyberanand1337x/bug-bounty-2022
• https://github.com/fengjixuchui/RedTeamer
• https://github.com/hectorgie/PoC-in-GitHub
• https://github.com/hktalent/TOP
• https://github.com/huimzjty/vulwiki
• https://github.com/jbmihoub/all-poc
• https://github.com/onewinner/VulToolsKit
• https://github.com/password520/RedTeamer
• https://github.com/slowmistio/CVE-2019-1003000-and-CVE-2018-1999002-Pre-Auth-RCE-Jenkins
• https://github.com/superfish9/pt
• https://github.com/weeka10/-hktalent-TOP
• https://github.com/wetw0rk/Exploit-Development