Create CVE-2017-1000353.yaml

[hnd3884]

/claim #11185

Jenkins Unauthenticated Remote Code Execution

Template / PR Information

Provide full url of Jenkins like below

nuclei -u http://192.168.180.1:8000 -t nuclei.yaml

The template exploit unsafe deserialization and execute command curl https://{{interactsh-url}} so use interactsh protocol as matcher

• Added CVE-2017-1000353
• References:
  • https://github.com/vulhub/CVE-2017-1000353

Template Validation

I've validated this template locally?

• YES
• NO

Additional Details (leave it blank if not applicable)

POC

Additional References:

• Nuclei Template Creation Guideline
• Nuclei Template Matcher Guideline
• Nuclei Template Contribution Guideline
• PD-Community Discord server

[algora-pbc]

👉 To complete your submission, sign up on Algora, link your Github account and submit the data for your PR.

[GeorginaReeder]

Thanks so much for your contribution @hnd3884 ! :)

[princechaddha]

@hnd3884, thank you so much for sharing this template with the community and contributing to this project 🍻

Can you confirm if this CVE can’t be written using HTTP/TCP + helpers or the JS protocol? We avoid adding code templates for CVEs that can be achieved using HTTP, TCP, or JavaScript, as such templates are blocked by default and won’t produce results. Therefore, we prioritize creating templates with other protocols unless exceptions are made.

[hnd3884]

Dear @princechaddha,

The reason i think it could not be written using HTTP/TCP + helpers or the JS protocol is that we have to prepare serialized data with complex steps (find index, , and the serialized payload also can not be generated by builtin ysoserial tool. The exploit steps are as same as CVE-2016-9299, with different gadget chain https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-9299.yaml . I tried both http and tcp and i'm not farmiliar with javascript

[hnd3884]

When i tried to use two tcp request, It work perfectly if i specify interact url and manually check for dns request. But when i use {{interactsh-url}} to auto detect using interact protocol, nuclei keeps return missing compiled operators for 'hex-byte-request' template