I'm from the Jenkins project.<p>I wish the authors of this post gave us a heads up beforehand. It put our users at unnecessary risk.<p>At Jenkins project, We've published a mitigation script (<a href="https://jenkins-ci.org/content/mitigating-unauthenticated-remote-code-execution-0-day-jenkins-cli" rel="nofollow">https://jenkins-ci.org/content/mitigating-unauthenticated-re...</a>) while we work out a better fix for users.
One thing I really liked about the write-up is the thoroughness that everything was explained. Nothing was assumed. The author explains what burp is why it was used. Broke down the basics in a high level and the touched on the simple things. Showed exploits in multiple frameworks. Really a well done article just from a write-up perspective let alone the impact of the issue.
This is very similar to the series of serialization vulnerabilities that hit the Ruby on Rails world in early 2013.<p>Black hats are going to have fun with this one. :-(
I had to backport a fix for a similar vulnerability in a Seam installation three years ago. The solution at the time was to limit the directories and sources from which serialized object representations could be read.