Jenkins

Directory map

• Jenkins — Discovery & Enumeration — fingerprinting, version detection, anonymous access, API enumeration, plugin discovery, default credentials
• Attacking Jenkins — Script Console RCE, Groovy command execution, reverse shells (Linux/Windows), vulnerabilities, data exfiltration, persistence

Summary

Jenkins is an open-source automation server for continuous integration and continuous deployment (CI/CD). It’s widely used in development environments and increasingly common on internal networks where it integrates with production systems.

Key characteristics:

• Port: Default 8080 (also 8000, 8888, 9000 in non-standard configs)
• Fingerprinting: Version exposed in HTTP headers and page source
• Authentication: Often uses weak/default credentials or no authentication
• Script Console: Groovy scripting interface for RCE (admin only)
• High privileges: Jenkins often runs as root or SYSTEM
• Secrets storage: Contains credentials for CI/CD pipelines and integrations
• Plugins: Extensible architecture; outdated plugins may have CVEs

Attack surface:

• Default credentials (admin:admin, jenkins:jenkins)
• Weak password brute-forcing
• Pre-authentication RCE via CVE-2018-1999002/CVE-2019-1003000 (Jenkins < 2.137)
• Script Console access = arbitrary code execution
• Anonymous access allows information gathering
• Plugin vulnerabilities (version-specific)
• Build artifact/log access may expose secrets

Common vulnerabilities:

• CVE-2018-1999002 & CVE-2019-1003000 — Pre-auth RCE (< 2.137)
• CVE-2019-1003000 — Script sandbox bypass
• Jenkins 2.150.2 — Node.js RCE
• Credentials exposed in build logs
• Hardcoded secrets in pipeline scripts

Post-exploitation value:

• Access to CI/CD infrastructure
• Extraction of credentials for multiple systems
• Code repository access
• Deployment environment access
• Lateral movement into production systems