shinigami-777/PoC_CVE-2024-28157

GitHubRepository PoCWriteup

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a README file that describes the CVE-2024-28157 vulnerability in the Jenkins GitBucket Plugin and provides manual exploitation steps. It does not contain any executable code, scanner logic, or automated detection mechanisms.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists solely of a README.md file describing a stored XSS vulnerability (CVE-2024-28157) in the Jenkins GitBucket Plugin. The text provides setup instructions using a standard Docker image, plugin installation via the Jenkins GUI, and manual exploitation steps involving a crafted XSS payload in the GitBucket URL field. No executable code, scripts, or commands are present in the reviewed text. The described behavior is consistent with the documented CVE and does not exhibit any concealed, deceptive, or operator-directed harm beyond the stated XSS proof-of-concept.

ClassificationWriteup
Model confidence95%
AuthenticationRequired
Languagesmarkdown
Target softwareJenkins GitBucket Plugin
Attack typesstored cross-site scripting (XSS)
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a README file that provides a technical description of the vulnerability and manual exploitation steps, but contains no executable code, scanner logic, or automated detection mechanism. It is a writeup.

README.md:1-23

Requirements

  • A Jenkins instance with the vulnerable GitBucket Plugin (version 0.8 or earlier) installed.README.md:4-6README.md:15
  • An attacker must be able to configure jobs in Jenkins.README.md:6

Observed behavior

  • The README describes manual steps to trigger a stored XSS vulnerability by inserting a JavaScript payload into the Gitbucket URL field of a Jenkins job configuration.README.md:18-20
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Xss Payload
javascript:alert('hello')The README instructs the user to manually enter this payload into the GitBucket URL field to demonstrate the stored XSS vulnerability. This is the expected behavior for a CVE-2024-28157 PoC.README.md:19
Review boundaries

What the analysis did not establish

  • The artifact contains only a README file; a second file (likely the exploit video) is present in the repository but its content is not included in the evidence packet.
  • The analysis is based solely on the supplied text; the described behavior has not been verified by execution.
  • One text file (likely a license) and one binary file (a video) from the repository were not included in the evidence packet and were not reviewed.
  • The review is limited to the provided text content; no dynamic analysis or execution was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1