A vulnerability in WebLogic, WebSphere, JBoss, Jenkins, OpenNMS and others

I&#x27;m from the Jenkins project.<p>I wish the authors of this post gave us a heads up beforehand. It put our users at unnecessary risk.<p>At Jenkins project, We&#x27;ve published a mitigation script (<a href="https:&#x2F;&#x2F;jenkins-ci.org&#x2F;content&#x2F;mitigating-unauthenticated-remote-code-execution-0-day-jenkins-cli" rel="nofollow">https:&#x2F;&#x2F;jenkins-ci.org&#x2F;content&#x2F;mitigating-unauthenticated-re...</a>) while we work out a better fix for users.

One thing I really liked about the write-up is the thoroughness that everything was explained. Nothing was assumed. The author explains what burp is why it was used. Broke down the basics in a high level and the touched on the simple things. Showed exploits in multiple frameworks. Really a well done article just from a write-up perspective let alone the impact of the issue.

Anyone actually have a CVE I can reference in talks to leadership so I can not look like a neckbeard security geek that&#x27;s acting self-important?

Kenn White said it best: &quot;This will get very ugly: unpatched, full remote exec on Java-based web svcs that use a popular serialization library

This is very similar to the series of serialization vulnerabilities that hit the Ruby on Rails world in early 2013.<p>Black hats are going to have fun with this one. :-(

<a href="https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;netsec&#x2F;comments&#x2F;3rrr9z&#x2F;what_do_weblogic_websphere_jboss_jenkins_opennms&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;netsec&#x2F;comments&#x2F;3rrr9z&#x2F;what_do_webl...</a><p><a href="http:&#x2F;&#x2F;mail-archives.apache.org&#x2F;mod_mbox&#x2F;commons-dev&#x2F;201511.mbox&#x2F;%3C20151106222553.00002c57.ecki%40zusammenkunft.net%3E" rel="nofollow">http:&#x2F;&#x2F;mail-archives.apache.org&#x2F;mod_mbox&#x2F;commons-dev&#x2F;201511....</a><p><a href="https:&#x2F;&#x2F;www.owasp.org&#x2F;index.php&#x2F;Information_leak_through_serialization" rel="nofollow">https:&#x2F;&#x2F;www.owasp.org&#x2F;index.php&#x2F;Information_leak_through_ser...</a>

The first thing I thought was &quot;written in Java&quot;. The more straightforward headline would have been better, I think.

I had to backport a fix for a similar vulnerability in a Seam installation three years ago. The solution at the time was to limit the directories and sources from which serialized object representations could be read.