Jenkins CLI Java Deserialization Remote Code Execution Vulnerability Analysis (CVE-2017-1000353)
Executive & SecOps Summary
SECOPS ASSESSMENTJenkins weekly versions 2.56 and earlier, and LTS versions 2.46.1 and earlier
Unauthenticated remote attackers can execute arbitrary system commands and fully compromise the Jenkins master node by sending a serialized Java SignedObject
Immediately upgrade Jenkins to version 2.57+ or LTS 2.46.2+, and disable the legacy remoting-based CLI protocol
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
The primary remediation is to upgrade Jenkins to a secure version (weekly 2.57 or later, LTS 2.46.2 or later).
# Upgrade Jenkins on Debian/Ubuntu systems
sudo apt-get update
sudo apt-get --only-upgrade install jenkins
sudo systemctl restart jenkins
# Upgrade Jenkins on RedHat/CentOS systems
sudo yum update jenkins
sudo systemctl restart jenkins2. Temporary Workaround & Hardening Configuration
If an immediate upgrade is not feasible, disable the vulnerable Remoting-based CLI protocol via the Jenkins Script Console.
// Run this in Jenkins Script Console (Manage Jenkins -> Script Console)
import jenkins.model.Jenkins
import java.util.logging.Logger
def logger = Logger.getLogger('security-patch')
def inst = Jenkins.getInstance()
// Disable Remoting-based CLI
inst.getDescriptor('jenkins.CLI').getApi().setEnabled(false)
inst.save()
logger.info('Jenkins Remoting CLI has been disabled successfully.')3. Log Audit & IoC Verification Commands
Use the following script to verify your Jenkins version and check if the CLI endpoint is exposed.
#!/bin/bash
# Check Jenkins version and CLI exposure
JENKINS_URL='http://localhost:8080'
echo '[+] Checking Jenkins Version...'
curl -sI $JENKINS_URL | grep -i 'X-Jenkins'
echo '[+] Checking CLI endpoint status...'
curl -sL $JENKINS_URL/cli | grep -E 'cli|remoting' && echo '[!] Warning: CLI endpoint is exposed.' || echo '[+] CLI endpoint is secure or disabled.'Scan Your Repositories for Transitive Vulnerable Dependencies in 30 Seconds
Automatically detect vulnerable packages across npm, PyPI, Maven, and Go, and open automated fix Pull Requests without breaking your build.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2017-1000353) is a critical Java deserialization flaw within the Jenkins CLI (Command Line Interface) subsystem. Jenkins previously employed a blacklist-based filtering mechanism to block dangerous classes during deserialization. However, security researchers discovered that the standard Java library class java.security.SignedObject could be leveraged to bypass this protection. Because SignedObject encapsulates another serialized object and deserializes it internally using a newly instantiated ObjectInputStream, it completely evades the pre-existing blacklist filters.
2. Exploitation Mechanics & Attack Scenario
An attacker crafts a malicious payload containing a gadget chain (such as CommonsCollections) nested inside a SignedObject. The attacker then initiates a connection to the Jenkins CLI port or tunnels the request via HTTP. When the Jenkins server receives and deserializes the SignedObject, the nested ObjectInputStream is triggered, bypassing the blacklist validation and executing the payload. Since this process requires no authentication, any internet-facing Jenkins instance is highly vulnerable to immediate compromise.
3. Infrastructure & Business Impact
As the orchestrator of CI/CD pipelines, Jenkins holds extensive privileges, including access to source code repositories, API keys, SSH credentials, and production environments. Successful exploitation allows attackers to gain shell access to the Jenkins master node, leading to credential theft, intellectual property exposure, or supply chain attacks where malicious code is injected into software builds. This poses an existential threat to enterprise infrastructure and business continuity.
Official Vendor Advisories & References
Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthenticated remote code execution vulnerability allowed attackers to transfer a serialized Java `SignedObject` object to the Jenkins CLI, that would be deserialized using a new `ObjectInputStream`, bypassing the existing blacklist-based protection mechanism. We're fixing this issue by adding `SignedObject` to the blacklist. We're also backporting the new HTTP CLI protocol from Jenkins 2.54 to LTS 2.46.2, and deprecating the remoting-based (i.e. Java serialization) CLI protocol, disabling it by default.
Frequently Asked SecOps Questions (CVE-2017-1000353)
FAQQ1. How critical is CVE-2017-1000353 and is it actively exploited in the wild?
CVE-2017-1000353 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 99.7%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2017-1000353?
Primary impacted vendors include jenkins across jenkins, jenkins_lts. Scope summary: Jenkins weekly 2.56 and earlier, LTS 2.46.1 and earlier (CISA KEV listed, EPSS score > 0.99, actively exploited in the wild)
Q3. What temporary mitigations or workarounds exist for CVE-2017-1000353 before patching?
[Mitigation] Immediately upgrade Jenkins to version 2.57+ or LTS 2.46.2+, and disable the legacy remoting-based CLI protocol Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2017-1000353
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (jenkins)
View Category →Apache MINA 3.0 JavaNativeMessageDecoder Deserialization Remote Code Execution Vulnerability (CVE-2026-118636)
[Affected Scope] Inactive Apache MINA 3.0.0 branch and applications utilizing its codec module
GitLab CE/EE Unauthenticated Remote Code Execution (RCE) Advisory (CVE-2026-97229)
[Affected Scope] GitLab CE/EE versions 19.2 (< 19.2.8), 19.3 (< 19.3.5), and 19.4 (< 19.4.2)
GitLab CE/EE Unauthenticated Arbitrary File Read Vulnerability (CVE-2026-85706)
[Affected Scope] GitLab CE/EE versions from 18.7 through 19.3.1.
Google Brotli Decoder Remote Code Execution (RCE) and Memory Corruption Vulnerability (CVE-2026-111497)
[Affected Scope] All web servers, browsers, Node.js environments, and backend applications using Google Brotli library versions 1.0.3 through 1.2.0
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.