This exploit targets an unauthenticated credential recovery vulnerability in Jenkins by extracting encrypted credentials from the credential store and decrypting them using the Groovy scripting engine. It demonstrates the ability to recover plaintext passwords without authentication.
Classification
Working Poc 95%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Reliable
Target:Jenkins v1.633
No auth needed
Prerequisites:Access to the Jenkins web interface · Credential store must contain stored credentials